Dispersed secure data storage and retrieval

ABSTRACT

A computer-implemented method that includes secure storage and retrieval of data is described herein.

CLAIM OF PRIORITY

This application is a continuation-in-part of and claims priority toU.S. patent application Ser. No. 12/614,670 filed Nov. 9, 2009 andentitled Centralized Internet Authentication and IdentificationTechnology with Safe Private Data Storage, which claims priority to U.S.Provisional Patent Application No. 61/150,084 filed Feb. 5, 2009,entitled Centralized Internet Authentication and IdentificationTechnology with Safe Private Data Storage, the entire contents of eachof which are hereby incorporated by reference.

FIELD

Computer systems and methods, computer program products and moreparticularly to electronic commerce conducted via computer networks aredescribed herein.

BACKGROUND

Authentication is the process of validating a set of credentials thatare provided by a party to a transaction or on behalf of such a party.Authentication is accomplished by verifying, through achallenge/response operation using various authentication protocols, oneor more of: something a party knows; something a party possesses; somecharacteristic about the party; or having one or more otherauthenticated parties vouch for the party being authenticated. Forexample, verification of something that a party knows may beaccomplished through a shared secret, such as a party's password, orthrough something that is known only to a particular party, such as aparty's cryptographic key. Verification of something that a partypossesses may employ a smartcard or other form of hardware token.Verification of a human party characteristic might employ a biometricinput such as a fingerprint or retinal map.

The role of the parties to a transaction may be characterized as userand service provider. The service provider delivers to the user viacomputer systems and networks some form or combination of information,information access, or access to resources. The service provider mayalso or instead perform some other function or service for or on behalfof the user.

SUMMARY

In some aspects, a computer-implemented method includes secure storageand retrieval of data by:

receiving data;

generating multiple data segments using calculations based on portionsof the data;

storing the data segments in different storage locations in multiple,different storage zones, with each of the storage zones storing lessthan a number of data segments required to recreate the data, and suchthat the data can be recreated based on the data segments retrieved fromless than all of the storage locations;

retrieving data segments from a particular set of storage locationsidentified based on a combination of data related to the user and datarelated to a service provider; and

manipulating data segments retrieved from the multiple storage locationsto recreate the data.

Embodiments can include one or more of the following.

The method can also include preventing recreation of the data from datasegments retrieved from a single storage zone.

The method can also include preventing recreation of the data from datasegments retrieved from a less than a specified number of the storagezones.

Storing the data segments in different storage locations can includestoring the data segments on storage media dispersed across multiplenetworked computers.

Receiving the data can include receiving encrypted data with theencrypted data being encrypted using an encryption key and encryptionalgorithm associated with the user, the encryption key andidentification of the encryption algorithm being stored on one or moretokens associated with the user. Recreating the data can includerecreating the encrypted data. The method can also include decryptingthe recreated encrypted data using the encryption key and encryptionalgorithm associated with the user.

Different storage locations can be different networked storage nodeswith each storage node including one or more networked computers andtheir associated data storage media.

Each of the multiple storage zones can be located in a geographical areathat is different from the geographical area the other ones of themultiple storage zones.

Each of the multiple storage zones can exist under a set of legaljurisdictions that is different from set legal jurisdictions of each ofthe other ones of the multiple storage zones.

Storing the data segments in a different storage locations can includestoring each data segment at a point within a storage location specifiedby a combination of data related to the user and data related to theservice provider.

The method can also include authenticating the user and the serviceprovider before storing or recreating the data.

The method can also include identifying a set of storage locations basedon the combination of data related to the user and data related to theservice provider by generating an data container identifier by:receiving, by an authentication system, a user ID and a service providerID; generating the data container identifier using a one-way functionbased on the user ID and the service provider ID.

Generating the data container identifier can include performing aone-way function based on the user ID, the service provider ID, and oneor more additional inputs.

Generating multiple data segments using calculations involving portionsof the data can include generating multiple data segments with eachsegment including a portion of less than all of the data with someportions of the data being included in multiple, different datasegments.

Generating multiple data segments using calculations involving portionsof the data can include generating multiple data segments where some ofthe data segments include identical portions of the data.

The above and other features of the present invention will be betterunderstood from the following detailed description of the preferredembodiments of the invention that is provided in connection with theaccompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings illustrate preferred embodiments of theinvention, as well as other information pertinent to the disclosure, inwhich:

FIG. 1A depicts a process for storing data in a dispersed, secure mannerand FIG. 1B shows a process for retrieving data in a dispersed, securemanner.

FIG. 2A depicts an overview of a data flow for generating an access codefor accessing data stored in a data container.

FIG. 2B shows an example of a data flow for generating an access codefor accessing data stored in a data container.

FIG. 3A shows an exemplary fragmentation and dispersion process.

FIG. 3B shows a graphically depicted example of the fragmentation anddispersion process of FIG. 3A.

FIG. 4A shows an exemplary data assembly and decryption process.

FIG. 4B shows a graphically depicted example of the data assembly anddecryption process of FIG. 4A.

FIG. 5A shows a system for providing secure access to data stored in auser's multiple, different data containers.

FIG. 5B shows a particular example of providing secure access to datastored in a user's multiple, different data containers.

FIG. 6 is a stylized overview of a system of interconnected computernetworks, one of which includes an authentication and dispersed datastorage (A&DDS) system;

FIG. 7 illustrates the A&DDS system of FIG. 6 in more detail along withits connections for interfacing with a service provider agent, userterminal and dispersed data storage system;

FIG. 8A is a block diagram of a token for use in the system of FIG. 7and FIGS. 8B-8E illustrate various embodiments of tokens;

FIG. 9 illustrates the user front end component of the A&DDS managementsystem with its main links to other parts of the system;

FIG. 10 illustrates the service provider front end component of theA&DDS management system with its main links to other parts of thesystem;

FIG. 11 illustrates the dispersed data storage system of the A&DDSmanagement system of FIG. 7 in more detail with its connections tovarious other components of the system;

FIG. 12A is a message sequence chart for user authentication at aservice provider and data retrieval according to a first embodiment ofthe present invention;

FIG. 12B is a message sequence chart for user authentication at aservice provider and data retrieval according to a second embodiment ofthe present invention;

FIGS. 12C and 12D are alternative embodiments of the message sequencechart of FIG. 12B;

FIG. 13 illustrates the components of an embodiment of a key managementsystem; and

FIG. 14 is message sequence chart illustrating a method of generatingand issuing a new token pair for replacement of a token.

DETAILED DESCRIPTION

Systems and methods for the secure storage of data through dispersionand through protection of the privacy of the data and its owner(s) aredescribed herein.

In some embodiments, the systems and methods described herein can allowdata to be safely stored while protecting privacy by one or more of thefollowing:

-   a) During the absence of the authenticated parties authorized to    store or retrieve the data, precluding any single or small subset of    storage media, and precluding the entirety of storage media, from    holding a recognizable or derivable copy of the data;-   b) Precluding the loss or revelation of data by damage, theft,    inspection or replication of storage facilities in one or a small    subset of storage media or the entirety of the storage media;-   c) During the absence of the authenticated parties authorized to    store or retrieve the data, precluding any determination of the    following by inspection of the system, its memory and its associated    storage:    -   the party(s) (e.g., user(s), service provider(s)) authorized to        store or retrieve the data;    -   any third-party service or application (e.g., service        provider(s)) used by a party (e.g., user) to create, store,        retrieve, modify, delete, or otherwise use the data;    -   the location(s) of any portion of the data.

In some embodiments, systems and methods described herein provideprocesses for encrypting and decrypting data so as to further protectthe privacy of the data and of its associated authorized parties. Insome examples, the systems and methods described herein use algorithmsand/or cryptographic keys known only to the party(s) authorized to storeor retrieve the data.

In some embodiments, systems and methods described herein can allow foran anonymous authentication method that can include one or more of thefollowing characteristics:

-   a) Limits storage and retrieval of the data to only the unique (but    otherwise anonymous) user that created or modified the data, and    only in conjunction with the specific, similarly-authenticated    service provider(s) used by the user to create or modify the data;-   b) Limits storage and retrieval of the data by a service provider to    only that portion of the user's data which was created or modified    with that specific service provider, and precludes access to any    other data created or modified by the same user with other service    providers;-   c) Prevents both the party and service provider from individually or    collectively repudiating the transaction that created or modified    the data;-   d) Prevents a false service provider from representing itself to the    user as the legitimate service provider; and/or,-   e) Prevents a false user from representing itself to the service    provider as the legitimate user.

In some aspects of the systems and methods for authentication describedherein, the user has a token that is unique but carries no personalinformation. The token can be a USB dongle or NFC-capable SmartCard. Anapplication or service provider also has a token that is unique andregistered with the authentication system. A transaction only takesplace when both parties (e.g., the user and service provider) haveauthenticated with the authentication system using their tokens.Additional authentication factors can also be supported such as twofactor authentication based on a token and passcode or three factorauthentication based on a token, passcode, and biometric information. Insome examples, a party can include a natural person, a program runningon a computer system, and/or other automaton. In some additionalexamples, a party can also include any third-party service orapplication used by a party to create, store, retrieve, modify, delete,or otherwise use the data.

As described herein, user authentication can include authentication ofthe system to the user. Service provider authentication can includeauthentication of the system to the service provider. Neither party cancomplete authentication with a false system attempting to misrepresentitself as the true system.

In some examples, system authentication occurs prior to userauthentication, such that if a party attempts authentication with afalse system, the authentication procedure fails before that partyreveals information critical to certifying the party's authenticity. Afalse system therefore cannot obtain information from the true partythat would enable a false party to misrepresent itself as the user or asthe service provider.

FIG. 1A depicts an overview of a process for storing data (e.g., storingpreviously un-stored data and/or modifying previously-stored data) in adispersed, secure manner and FIG. 1B shows a process for retrieving data(e.g., retrieving data can includes deleting or rendering inaccessibleto any party, including the storage system itself the previously-storeddata from the storage system and/or rendering the previously-stored dataotherwise inaccessible) in a dispersed, secure manner. The storage ofdata in a secure manner is tightly coupled with authentication of theparties that store the data. For example, to ensure the authenticity ofthe parties and enable secure storage, prior to acceptance by the systemof the data for storage, the user is authenticated via a secure butanonymous method 31. Requiring the user to be authenticated can providethe advantage of allowing the user to feel confident that his/heridentity cannot be mimicked and that the data will be safe from bothinternal and external threats. For example, the user can beauthenticated using one or more of the authentication methods describedherein. Also, prior to acceptance by the system of the data for storage,the service provider is authenticated via a secure method 32. Requiringthe service provider to be authenticated in addition to the user canprovide the advantage of providing assurance to the user that he istalking to or interacting with a real service provider. For example, theservice provider can be authenticated using one or more of theauthentication methods described herein. As noted herein, theauthentication can be bi-lateral (requiring both the user and theservice provider to be authenticated prior to entering a transaction)which provides the benefit of both user and service provider beingmutually assured of the other's authenticity.

Authentication systems and methods described herein are believed toprovide various advantages. In some examples, the authentication andstorage of the data limits storage and retrieval of the data to only theunique (but otherwise anonymous) user that created, modified, or causedthe creation or modification of the data, and only in conjunction withthe specific, similarly-authenticated service provider (e.g., a programrunning on a computer system or other automaton providing a service orapplication such as a data storage service, financial transactionservice, digital rights management service, etc.) employed by the userto create or modify the data. It is also believed that theauthentication processes described herein provide an advantage oflimiting the storage and retrieval of the data by a service provider toonly that portion of the data which was created or modified by thatspecific service provider with that specific user. Thus, a user canauthenticate with multiple different service providers using a singledevice without fear that any service provider will be able to share orotherwise access other similarly-stored information associated with adifferent service provider. In some additional examples, theauthentication processes described herein can prevent both the user andservice provider from individually or collectively repudiating thetransaction that created or modified the data. This provides theadvantage of validating the transaction. In some additional examples,the authentication processes described herein can prevent a falseservice provider from representing itself to the user as the legitimateservice provider. This can provide the advantage of allowing a user tobe confident of the service provider's identity when entering atransaction with the service provider. In some additional examples, theauthentication processes described herein can prevent a false user fromrepresenting itself to the service provider as the legitimate user.Similarly, this can provide the advantage of allowing a service providerto be confident of the user's identity when entering a transaction withthe service provider.

Returning to FIG. 1A, prior to acceptance of the data for storage, thedata is encrypted 33, The data can be encrypted by an algorithm and/orcryptographic key known only to the party using, for example, one ormore of the encryption methods described herein. Also described hereinare systems and methods for encryption and decryption of data usingalgorithms and/or cryptographic keys known only to the party(s) thatcreated the data. Using such algorithms can provide the advantage ofprotecting the privacy of the data.

After encryption and prior to storage of the data, the encrypted data isfurther obfuscated and fragmented 34. The data can be obfuscated andfragmented using, for example, one or more of the fragmentation methodsdescribed herein. In general the obfuscation and fragmentation methodsdescribed herein obfuscate and fragment the data such that:

-   a) no fragment represents by itself any portion of the encrypted    data;-   b) no small subset of fragments can be used to determine the    encrypted data; and-   c) a larger subset of fragments, but not all fragments, are    sufficient to determine the encrypted data without error.

After obfuscation and fragmentation of the encrypted data, the fragmentsare dispersed for storage 35. The dispersal can be accomplished using,for example, one or more of the dispersion techniques described in moredetail herein and which disperse the segments such that:

-   a) no subset of fragments sufficient to determine the encrypted data    resides within a single or small subset of places;-   b) the identification of point within the data storage location for    each stored fragment can only be determined by a combination of a    unique code assigned to the user, a unique code assigned to the    service provider, and, optionally, other codes dependent on the    application implemented by the service provider; and/or-   c) the identification of location cannot be used to determine any of    the codes just described.

Prior to retrieval of the data from storage, the user is authenticated36. The user can be authenticated via a secure but anonymous method suchas the authentication methods described herein. Because theauthentication is anonymous to authenticator, the system can provide theadvantage of eliminating the need for the authenticator or the serviceprovider to store a database of identities.

Prior to retrieval of the data from storage, the service provider isalso authenticated 37. The service provider can be authenticated via asecure method such as the authentication methods described herein. Uponcorrect authentication of the user and service provider, a sufficientsubset of fragments is retrieved from dispersed data storage and theencrypted data determined therefrom 38. The encrypted data is deliveredto service provider for decryption 39. The encrypted data can bedecrypted using, for example, an algorithm and/or cryptographic keyknown only to one of the parties using one or more of the methodsdescribed herein.

FIG. 2A depicts an overview of a data flow for generating an access code(also referred to herein as a data container identifier) for accessingdata stored in a data container 10. The data container 10 stores a datathat a particular service provider is allowed to access, use and/ormodify with the permission of the user. The data container 10 can beanalogized to a virtual safe deposit box, where two keys are needed toopen the virtual safe deposit box, with one key 22 belonging to theservice provider and the other key 28 belonging to the user. To open thevirtual safe deposit box (e.g., to access the data in the data container10), both the user 26 and the service provider 20 must provide theirkeys 28 and 22 which, when combined, generate a unique data containeridentifier 14 that enables access to the data stored in the datacontainer 10. As such, because keys are needed from both the serviceprovider 20 and the user 26 to determine the location of the data,access to the data stored in the data container 10 is restricted to theauthorized user/service provider pair. Requiring keys from both theservice provider 20 and the user 26 additionally can provide theadvantage of providing a system in which the storage provider 20 has noaccess to data except when the authenticated user 26 is present.

More particularly, the user 26 and the service provider 20 each haveunique tokens 27 and 21 respectively. The tokens provide informationused to authenticate the user 26 and the service provider 20 and toaccess the data in the data container 10. The tokens can, for example,take the form of a portable device such as a dongle or a keycard or beincorporated in another device such as a mobile phone. Token 27includes, among other information, identity information in the form of auser ID 28. Similarly, the service provider token 21 includes, amongother information, identity information in the form of a serviceprovider ID 22. Prior to allowing access to the information in the datacontainer 10, both the user 26 and the service provider 20 areauthenticated by an authentication system (not shown) based oninformation provided via their respective tokens 27, 21. Theauthentication system authenticates not only the user 26 but also theservice provider 20 before allowing access to the secured data in thedata container 10. While the user ID 28 and the service provider ID 22become known to the authentication system during the authenticationprocess, they are retained in the authentication system for a limitedlength of time. After authentication of the service provider and theuser, the user ID 28 and the service provider ID 22 are combined togenerate the unique data container identifier 14 that identifies thelocation of the data container 10.

In one particular simplified example of a combination method to generatea data container identifier shown in FIG. 2B, a concatenation of theuser ID 28 and the service provider ID 22 forms the unique datacontainer identifier 14. For example, the user ID 28 and the serviceprovider ID 22 can each be a sting of alphanumeric characters (e.g., astring of 64 digits). In the example to follow the user ID 28 and theservice provider ID 22 are described as a string of eight numeric digitsfor simplicity. If one were to assume the user ID 28 was the eight digitstring of “33445566” and the service provider ID 22 was the eight digitstring of “13579246”, the unique data container identifier 14 can begenerated based on a concatenation of the user ID 28 and the serviceprovider ID 22 (e.g., user ID & service provider ID) resulting in aunique data container identifier 14 of “3344556613579246”.

While the example in FIG. 2B above is based on a simple concatenation ofthe user ID and the service provider ID, other functions that combinethe service provider ID with the user ID to form a unique data containeridentifier can be used. In general, any function ofƒ(x,y)=kcan be used to combine x and y (e.g., the user ID and the serviceprovider ID, respectively) to create k, the data container identifier14, as long as the function ƒ(x,y) generates a unique result for eachcombination of x and y. One example of such a function is a one waypermutation, a function ƒ_(OWP)(x,y) in which k can be easily calculatedbut by which cannot be easily reversed, e.g., knowing k, one cannoteasily determine x or y. One benefit of using a one way permutation togenerate the data container identifier 14 is that, were one to receivethe data container identifier 14, the two IDs used to generate the datacontainer identifier (e.g., user ID and the service provider ID) couldnot be easily determined. An exemplary one way permutation is describedbelow. However, other irreversible one way functions can be used to formthe data container identifier 14. The use of an irreversible one wayfunction provides additional security in comparison to use of areversible function such as the one described in FIG. 2B.

In some additional examples the unique data container identifier 14 notonly can be based on a combination user ID 28 and the service providerID 22 (e.g., as described above), but also may include additionaldata/variables as input to the function (e.g., ƒ(x,y,z)=k) or asadditional iterations of the function (e.g., ƒ(z, ƒ(x,y))=k) or ascombinations of different functions (e.g., ƒ(z, g(x,y))=k).

In addition to restricting access to the information stored in the datacontainer 10 based on the unique data container identifier 14 formedbased on the user ID 28 and service provider ID 22, the data stored inthe data container 10 can be further protected by encryption anddispersal of the data. In general, before being stored in the datacontainer, data is encrypted, fragmented, and dispersed to multiple datastorage locations. When needed, the data from the multiple data storagelocations is retrieved, re-assembled and delivered to an authorizedrecipient for decryption.

An exemplary fragmentation and dispersion process is shown in FIG. 3Aand graphically depicted in FIG. 3B. In general, the fragmentation anddispersion processes described herein can provide systems and methodsfor safe data storage in many places while simultaneously protecting theprivacy of the data and its owner(s). These systems and methods allowthe data to be safely stored while protecting privacy by one or more ofthe following: precluding any single or small subset of places fromholding a recognizable or derivable copy of the data; precluding theloss of data by the destruction, theft or replication of data storagelocations in one or a small subset of places (e.g., all data storagelocations within one country); precluding the determination of the party(e.g., a natural person, a program running on a computer system, orother automaton) that created, modified, or caused the creation ormodification of the data.

In FIG. 3A a process receives 46 unencrypted data (e.g., unencrypteddata 58, FIG. 3B). The unencrypted data is encrypted 48 to generateencrypted data (e.g., data 60, FIG. 3B). The encryption can employvarious encryption processes. For example the token 27 can includecryptographic information and the data encryption can occur on the token27. This method allows the data to be encrypted without thecryptographic information being communicated outside of the token, thusincreasing the security of the cryptographic information.

In some examples, however, communication of the unencrypted data to thetoken from the user computer and communication of the encrypted datafrom the token to the user computer (and ultimately to the A&DDS system)may be time consuming due to limited processing power of the token andor the data transfer rate between the token and the user computer. Insome alternative examples, rather than encrypting the data on the token,the token generates a unique file encryption key which the secure datastorage application uses to encrypt the file. The file encryption key isencrypted with the user encryption key in the token and stored (in theencrypted form) with the file. Other encryption processes couldadditionally/alternatively be used to encrypt the data. Allowing data tobe transmitted to/from the data storage locations 12 in encrypted form(e.g., the data is encrypted prior to uploading the data to the datastorage locations and is decrypted only after the data has beenretrieved from the data storage locations) provides an additional levelof data security.

Once the data is encrypted, the data is sent 50 to the A&DDS system. TheA&DDS system receives 52 the encrypted data and then obfuscates andfragments 54 the encrypted data into multiple fragments (e.g., encryptedand obfuscated data fragments 62, FIG. 3B). The A&DDS system determines55 data storage locations and points therein to which to dispersefragmented data based on a data container identifier generated using acombination of a user ID and service provider ID and, optionally, otherfactors. The A&DDS system stores 56 the fragments in the determineddispersed data storage locations (e.g., data storage locations 64, FIG.3B, akin to data storage locations 12 of FIG. 2A).

In some additional examples, the A&DDS system may receive data that iseither encrypted or unencrypted. The received data is (further)encrypted by using an encryption key formed from a combination (e.g,using a one-way hash function) of the User ID, the Service Provider ID,and optionally other factors. This encryption key is never stored, butre-created when needed to store or retrieve data and only after theauthentication of the user and of the service provider. Since the A&DDSsystem cannot create this encryption key without the presence of theauthenticated user and of the authenticated service provider, during theabsence of either party the stored data cannot be decrypted.

Data storage locations are separated according to specific designcriteria. For example, the data storage locations can be located indifferent geographic zones such as on multiple continents, in multiplecountries or states, or separated by a geographic distance that is greatenough to eliminate the concern that a single natural disaster orphysical attack could eliminate access to multiple locations (or evenevery location in a particular zone) such that the data could not bereassembled from the remaining available locations (e.g., a distancegreater than 10 miles, greater than 50 miles, or greater than 100miles). In another example, the data storage locations can be located indifferent legal jurisdictions such that the data could not bereassembled from the locations available within a subset of one or morelegal jurisdictions, and such that the data could always be reassembledfrom other locations outside of any arbitrary subset of one or morelegal jurisdictions. In another example, the data storage locations canbe confined to locations within a set of one or more legal jurisdictionssuch that the data can always be reassembled from the locationsavailable within one (or a small subset) of those legal jurisdictionsregardless of events occurring within other legal jurisdictions. Inanother example, the data storage locations can be confined to a set oflocations controlled by a set of one or more organizations (e.g.,corporation or a government department) such that the data can always bereassembled from the locations available within a particular one (or asmall subset of those) organization(s) and simultaneously can never bereassembled using only locations available outside that particular one(or small subset of) organization(s). Such design criteria asillustrated by these examples can be used singularly or in logicalcombinations, depending on business, technical, regulator or other needsfor the specific instance of implementation of these systems andmethods.

The data is dispersed using an information dispersal algorithm (e.g.,using one or more of the information dispersal algorithms describedherein), making it impossible to reconstruct the encrypted data, inwhole or in part, without accessing and receiving data from at least apredefined minimum number of different locations. As a result theft ofthe contents of any combination of locations less than this minimum willnot permit assembly of even the encrypted data. Additionally, even if athief were to hold the encrypted data, the thief cannot derive eitherthe service provider ID or the user ID of the service provider and userwho stored the data. Additionally, even if the thief of the data somehowwere to obtain the encrypted data, the user ID, and the service providerID, the thief could not view the data because (as described in moredetail herein) the thief could not decrypt the data as none of thesystems hold any of the encryption/decryption keys or the identificationof the encryption algorithm needed for decryption.

In addition to storing the data in a dispersed manner requiring aminimum number of locations to reconstruct the decrypted data, the datais dispersed in a manner that provides redundancy in the data, enablingreconstruction of the data from a subset of less than all of thelocations. Storing the data in such a dispersed manner can eliminatesingle points of vulnerability to physical, electronic or internalattack because if a particular location is not available for dataretrieval, the redundancy in the data enables the data to bereconstructed without requiring access to the unavailable location.Thus, the data is stored redundantly in many places while simultaneouslynot existing in any one particular place or region. The data belongs toand can only be obtained and decrypted by a specific user and serviceprovider. However the system storing the data does not know which useror service provider stored the data nor can it decrypt the data even ifthe user and service provider were known.

For example, in a simplified example with only three dispersed datastorage locations any one of the data storage locations can beinoperable and the data can still be restored based on the remainingavailable locations. Assuming the user begins with unencrypted data thathe/she desires to store in a secure manner, the user encrypts the datato form encrypted data, represented in this example as “12345678”. Theencrypted data is sent to the A&DDS system and the A&DDS systemfragments the data into multiple different fragments. For example, theencrypted data can be divided into two fragments where fragment #1 is“1234” and fragment #2 is “5678”. (Note: for clarity obfuscation is notincluded in this simple example.) To generate an additional datafragment, the A&DDS system calculates some derivative of the twofragments such as the modulus₁₀ sum of fragment #1 and #2 resulting in afragment #3 of “6912”. The three fragments are then stored in disperseddata storage locations. For example fragment #1 could be stored in theUnited States, fragment #2 could be stored in Germany, and fragment #3could be stored in Australia. In this example the encrypted data can berestored using the fragments from any two of the data storage locations.For example if the location located in the United States wereinoperable, the encrypted data can be restored based on the datafragments stored in Germany and Australia as further described below.

In the simple example above some of the fragments included portions ofthe encrypted data. In a more secure example the fragmentation methodsimultaneously obfuscates the fragments with a mathematical function g() chosen such that no fragment includes a direct representation of anyportion of the encrypted data. For example the encrypted data “12345678”can be obfuscated and fragmented by the function g(12345678) intomultiple fragments of “802752”, “913466”, “482346”, etc. In such anobfuscation and fragmentation method the disclosure of any fragment doesnot disclose a portion of the encrypted data. Methods of obfuscation andfragmentation are described in more detail herein.

An exemplary data assembly and decryption process is shown in FIG. 4Aand a graphically depicted example is shown in FIG. 4B. In general, whenneeded, the data from a subset of the multiple data storage locations isretrieved, re-assembled and delivered to an authorized recipient fordecryption. As noted herein, however, the data cannot be located nor canit be retrieved without the presence of both permitted, authenticatedparties because the data container identifier used to retrieve the datacontainer from points within multiple dispersed data storage locationsis based on processing of a combination of the parties' user ID and theservice provider ID. Due to the redundancy in the stored data during thedispersion process, the data from a subset of the data storage locationsis sufficient to reassemble the encrypted data. Thus, if one or more ofthe data storage locations is non-functional or inaccessible, the datacan nevertheless be reassembled using other data storage locations.

More particularly the A&DDS system identifies 65 fragments for retrievalbased on a data container identifier that is based on a combination of auser ID and service provider ID and, optionally, other factors. TheA&DDS system retrieves 66 the fragments from at least some of thedispersed data storage locations identified based on the data containeridentifier and reassembles 68 the data fragments to generate theencrypted data. The encrypted data are sent from the A&DDS system andreceived 69 by the authorized recipient process. The recipient processdecrypts 70 the encrypted data.

Using FIG. 4B, an example is described where redundancy enablesreconstruction based on only some of the dispersed data storagelocations. In this example data from six of the ten data storagelocations (e.g., locations identified with reference numerals 72 a, 72b, 72 c, 72 d, 72 e, and 72 f) is retrieved. The A&DDS systemreassembles 68 the retrieved data fragments 76 to regenerate theencrypted data 78. The encrypted data 78 is decrypted 70 to generateunencrypted data 79.

For example, continuing the simplified example above with only threedispersed data storage locations storing fragments #1, #2 and #3, theA&DDS system identifies the locations of the fragments within thedispersed data storage locations and assembles data from a subset of thedata storage locations to reproduce the encrypted data. In this example,data from any two of the three data storage locations is sufficient toreassemble the encrypted data. For example, if fragment #1 of “1234” andfragment #2 of “5678” are retrieved then the A&DDS system merges thedata to reconstruct the original encrypted data of “12345678”. Iffragments #1 and #3 are retrieved, then fragment #2 can be determined bysubtracting modulus₁₀ fragment #1 (“1234”) from fragment #3 (“6912”) toreproduce fragment #2. Similarly, fragments #2 and #3 are retrieved,then fragment #1 can be determined by subtracting modulus₁₀ fragment #2(“5678”) from fragment #3 (“6912”) to reproduce fragment #1. Thus, inthis example the encrypted data can be restored using the fragments fromany two of the data storage locations.

In some aspects, a user can desire to have a single device that iscapable of providing an authentication method for multiple, differentapplications. This can provide the advantage of convenience for the userand encourage the user to take appropriate actions to protect thedevice/information used in the authentication process. For example, auser can have multiple, different data containers with access to each ofthe data containers being restricted to a particular service provider.FIG. 5A shows a system for providing secure access to data stored inmultiple, different data containers 80 a and 80 b. While only two datacontainers are shown, a user can have any number of data containers witheach data container being associated with a different service provider.Each data container 80 a and 80 b stores data that a particular serviceprovider is allowed to access, use and/or modify with the permission ofthe user. As described herein, access to a data container is restrictedto a user/service provider pair based on a data container identifier(e.g., data container identifiers 82 a and 82 b) that is generated froma user ID 86 and the service provider ID (e.g., service provider IDS 84a or 84 b). The user ID 86 for generating the data container identifierfor each of the data containers 80 a and 80 b is the same. Thus, theuser is provided with access to multiple, different data containersusing a single token 88 that provides the user ID 86. However, while theuser ID 86 used to generate the data container identifiers 82 a and 82 bfor accessing different data containers 80 a and 80 b is the same, theservice provider ID used to generate the data container identifiers 82 aand 82 b will differ based on the service provider associated with thedata container. For example, data container 80 a is associated withservice provider A and the corresponding data container identifier 82 ais based on a combination of the service provider ID 84 a for serviceprovider A and the user ID 86, while data container 80 b is associatedwith service provider B and the corresponding data container identifier82 b is based on a combination of the service provider ID 84 b forservice provider B and the user ID 86.

In one simplified example shown in FIG. 5B, a user has multiple,different data containers 91 a and 91 b with access to each of the datacontainers being restricted to a particular service provider (e.g.,access to data container 91 a is limited to the user and serviceprovider A and access to data container 91 b is limited to the user andservice provider B). In the example to follow the user ID 96, theservice provider ID 94 a, and the service provider ID 94 b are describedas a string of 5 numeric digits for simplicity. For example, if one wereto assume the user ID 96 was the 5 digit string of “44444”, the serviceprovider ID 94 a was the 5 digit string of “12345”, and the serviceprovider ID 94 b was the 5 digit string of “67890”, then the unique datacontainer identifiers 92 a and 92 b for data containers 91 a and 91 brespectively can be generated based on a concatenation of the user ID 96and the respective service provider ID (i.e., service provider ID 94 afor data container 91 a and service provider ID 94 b for data container91 b). As such, the data container identifier for data container 91 a is“4444412345” while the data container identifier for data container 91 bis “4444467890”.

While the example in FIG. 5B above is based on a simple concatenation ofthe user ID and the service provider ID, other functions that combinethe service provider ID with the user ID to form a unique data containeridentifier can be used such as the one-way permutation functionsmentioned above and discussed in further detail below. The datacontainer identifiers generated by those functions are unique to eachuser-service provider pair. Furthermore, were one to receive any datacontainer identifier so generated, neither the user ID nor the serviceprovider ID) could be easily determined.

This description of the exemplary embodiments is intended to be read inconnection with the accompanying drawings, which are to be consideredpart of the entire written description. Terms concerning attachments,coupling and the like, such as “connected” and “interconnected”, referto a relationship wherein components communicate to one another eitherdirectly or indirectly through intervening structures, unless expresslydescribed otherwise.

A centralized authentication system with safe private data storage andmethod of providing centralized authentications with safe private datastorage are described herein in connection with the figures. In thefollowing description, it is to be understood that system elementshaving equivalent or similar functionality are designated with the samereference numerals in the figures. It is to be further understood thataspects of the present invention may be implemented in various forms ofhardware, software, firmware, or a combination thereof. In particular,various system modules described herein are preferably implemented insoftware as an application program that is executable by, e.g., ageneral purpose computer or any machine or device having any suitableand preferred microprocessor architecture. The various functionalitiesdescribed herein is preferably implemented on a computer platformincluding hardware such as one or more central processing units, arandom access memory, and input/output interface(s). The computerplatform also includes an operating system and microinstruction code.The various processes and functions described herein may be either partof the microinstruction code or application programs which are executedvia the operating system. In addition, the computer platform may includevarious other functional software elements (e.g., network drivers,communication protocols, etc.) as well as other peripheral devicesconnected to the computer platform such as an additional data storagedevice.

Various aspects of the present invention can be embodied in the form ofmethods and apparatus for practicing those methods. Code to implementthe present invention may be embodied in the form of program codeoperably disposed in tangible media, such as in system memory or storedon data storage media such as a fixed disk, floppy disk, CD-ROM, harddrives, or any other machine-readable data storage medium wherein, whenthe program code is loaded into and executed by a machine, such as acomputer, the machine becomes an apparatus for practicing the invention.The code for implementing various aspects of the present invention maybe transmitted over some transmission medium, such as over electricalwiring or cabling, through fiber optics, or via electromagneticradiation, wherein, when the program code is loaded into and executed bya machine, such as a computer, the machine becomes an apparatus forpracticing the invention. When implemented on a general-purposeprocessor, the program code segments combine with the processor toprovide a unique device that operates analogously to specific logiccircuits. For the purpose of this disclosure, the term “processor” maybe used to refer to a physical computer or a virtual machine.

It is to be further understood that, because some of the constituentsystem components described herein are preferably implemented assoftware modules, the actual system connections shown in the figures maydiffer depending upon the manner in which the systems are programmed. Itis to be appreciated that special purpose microprocessors may beemployed to implement various aspects of the present invention. Giventhe teachings herein, one of ordinary skill in the related art will beable to contemplate these and similar implementations or configurationsof the present invention.

For example, while in some embodiments described above the storage isdispersed among multiple locations, in some aspects the authenticationand storage can be used in a system that does not include dispersedstorage (e.g., the data is stored in a single location).

Before describing in detail the various aspects of the presentinvention, a general introduction to an environment in which theinvention may be deployed is presented in connection with FIG. 6.

With reference to FIG. 6, the Internet 114 is a worldwide system ofcomputer networks—a network of networks in which a user at one computeror other device connected to the network can obtain information from anyother computer and communicate with users of other computers or devices.The most widely-used part of the Internet is the World Wide Web(often-abbreviated “WWW” or called “the web”). One of the mostoutstanding features of the web is its use of hypertext, which is amethod of cross-referencing. In most web sites, certain words or phrasesappear in text of a different color than the surrounding text. This textis often also underlined. Sometimes, there are hot spots, such asbuttons, images, or portions of images that are clickable. Clicking onhypertext or a hot spot causes the downloading of another webpage via aprotocol such as hypertext transport protocol (HTTP). Using the webprovides access to millions of webpages of information. Web surfing isdone with a web browser, such as Apple Safari® and Microsoft InternetExplorer® browsers. The appearance of a particular website may varyslightly depending on the particular browser used. Versions of browsershave plug-ins which provide animation, virtual reality, sound, andmusic. Interpreted programs (e.g., applets) may be run within thebrowser.

FIG. 6 shows a plurality of interconnected computer system networks 102and remote user terminals 110. More specifically, the networks 102 maybe computer system networks run by service providers. A typicalnetworked computing environment can be broadly described as comprisingusers and service providers. A service provider delivers some form ofinformation, informational access, or access to resources to a userelectronically via computer systems and networks, such as those shown inFIG. 6. A user may be regarded as a consumer of the provided service. Ingeneral, many different types of service providers may be present in agiven networked environment, such as the environment shown in FIG. 6.Online merchants represent a class of e-commerce service providers,while web portals represent a class of information service providers.Internet service providers are entities that provide a networkcommunication link to the Internet as a service. Many of these serviceproviders provide access to their particular service or resource onlyafter a user has been properly authenticated. The service provider thenmakes use of the aspects of the user's identity it has been authorizedto access. Non-limiting examples of service providers include public orcorporate web services such as e-commerce sites (e.g., amazon.com),public mail servers (e.g., mail.google.com), wikis, social networkservices (e.g., facebook.com), traditional brick-and-mortar merchantsystems (e.g., sales systems at Macy's or Home Depot), and traditionaland on-line banking services, to name a few.

Each service provider computer system network 102 may include acorresponding local computer processor unit 104, which is coupled to acorresponding local data storage unit 106 and to local user terminals108. A service provider computer system network 102 may be a local areanetwork or part of a wide area network, for example.

The illustrated environment also includes a third-party (i.e., not auser and not a service provider as discussed above) A&DDS system 202,which includes a processing system identified as the A&DDS managementsystem 204. In certain embodiments, the A&DDS management system 204provides a vehicle for providing mutual authentication during atransaction. That is, the authentication operations of the system can beused to authenticate not only the user but also the service providerbefore any data from its secured data storage is released. Moreover, aspart of this authentication process, the A&DDS management system 204itself can be authenticated to the user and the service provider asprovided in more detail in the remainder of this description. The A&DDSmanagement system 204 includes local user terminal(s) 201 (used toperform administrative actions, for example) and local data storage 203.The A&DDS system 202 is shown coupled to remote user terminals 110 andservice provider computer system networks 102 through the Internet 114,but it should be understood that communications between these devicesand networks can also be by way of a private network or dedicatedconnection.

Each of the plurality of user terminals 108, 110 may have variousdevices connected to their local computer systems, such as scanners,barcode readers, printers, fingerprint scanners, mouse devices,keyboards, and other interface devices such as the token interface 112described in more detail below.

The computer processor unit 104 of the service provider computer systemnetwork 102 can take the form of a server and front-end graphical userinterfaces (GUIs) for providing its associated services/resources touser terminals 108, 110. The computer processor unit 104 can alsoprovide back-end GUIs, for example, used by system administrators. Userterminals 108, 110 are said to be clients of the computer processor unit104. A client is any computer or device that is capable of connecting toa server computer or device (referred to as the host) through a network,wired or wireless. A client may also refer to computer software orfirmware that communicates with (e.g., calls and connects) to a server.The aforementioned GUIs can take the form of, for example, a webpagethat is displayed using a browser program local to the user terminal108, 110. Front- and back-end GUIs may be portal webpages that includecontent retrieved from the one or more data storage devices 106. As usedherein, portal is not limited to general-purpose Internet portals, suchas Yahoo! or Google but also includes GUIs that are of interest tospecific, limited audiences and that provide the user access to aplurality of different kinds of related or unrelated information, linksand tools as described below.

A user may gain access to the services/resources provided by a serviceprovider's computer processor unit 104 of the computer system network102 by using a user terminal 108, 110, programmed with a web browser orother software, to locate and select (such as by clicking with a mouse)a particular webpage accessible via local area network. The content ofthe webpage is located on the one or more data storage devices 106. Theuser terminals 108, 110 may be microprocessor-based computer terminalsthat can communicate through the Internet using the Internet Protocol(in), kiosks with Internet access, connected personal digital assistants(e.g., a Palm® device manufactured by Palm, Inc., iPaq® device availablefrom Compaq, iPhone® from Apple, Inc. or Blackberry® device from RIM),or other devices capable of interactive network communications. Userterminals 108, 110 may be wireless devices, such as a hand-held unit(e.g., a cellular telephone or a portable music player such as an iPod®device) that connect to, and communicate through, the Internet using awireless access protocol or other protocols. Other types of devices mayalso be substituted in the system for user terminals 108, 110. Onenon-limiting example may be a door lock having an embedded processorwithout a visual browser that generates GUIs for a user display, such aprocessor instead making hidden requests to a predefined web server andin accordance with a reply from the web server performing someoperations, e.g., triggering a switch or relay, responding with a reply,etc. In order to access a secure area, the user presents a token to anappropriately configured reader. The service provider in this examplecan be viewed as the corporate information technology or securitysystem.

The system and method described herein may be implemented by utilizingall or part of the environment described above in connection with FIG.6. It should be apparent to one of ordinary skill in the art that thesystem may be incorporated in a local area network, in a wide areanetwork, or through an Internet 114-based approach, such as through ahosted or non-hosted application service, or through a combinationthereof.

FIG. 7 illustrates a particular embodiment of a centralizedauthentication system with safe private data that may be implementedusing the computing environment illustrated in FIG. 6. The A&DDSmanagement system 204 includes a service provider front end 205 forinterfacing with the service provider agent 220, a user front end 208for interfacing with the combined user terminal/token interface 222, adispersed data storage management system 210, and a key managementsystem 212. A token 27 communicates with the user terminal/tokeninterface 222, which is in communication with the service provider agent220 either locally or remotely through the Internet 114. The serviceprovider agent 220 and the user terminal/token interface 222 communicatewith the A&DDS management system 204 through a network such as theInternet 114.

Although FIG. 7 illustrates a single service provider front end 205 anda single user front end 208, it should be understood that this is forillustrative purposes only. That is, in embodiments the system caninclude multiple instances of both the service provider front end 205and the user front end 208 each with its own respective address. Thesefront ends can be located at a single location or at multiple locations.This provides two advantages. First, for a dispersed system, users andservice providers can be connected to the nearest or most convenientfront ends. Second, in the case a location fails, it is still possiblefor service provider and user to access other front ends.

As described above, a service provider delivers some form ofinformation, informational access, or access to other resources orservices (collectively or individually, “resource”) to a userelectronically via computer systems and networks, such as those shown inFIG. 6. A user may be regarded as a consumer of the provided service.The service provider can be thought of as an entity that provides someInternet (or other networked) service either directly to the user (e.g.,e-commerce) or indirectly (e.g., through a third party). In a secondsense, the service provider can be thought of as combination of computerprograms, computers, network links that implement the functionality ofthis Internet (or other networked) service. Therefore, in order toresolve this uncertainty, this later aspect of the service provider isreferred to herein as the service provider agent 220. The computerprograms used by service providers to implement the service provideragent 220 include web servers and data base management systems, to namea few.

The A&DDS management system 204 is in communication with the disperseddata storage system 216 through a network 214, which may be a publicnetwork such as the Internet 114 or a private network. The disperseddata storage system 216 includes multiple dispersed and networked datastorage locations 218.

The system shown in FIG. 7 is designed to facilitate user authenticationwith service providers for secure interactions between users and serviceproviders, as well as provide secure data storage of data on behalf ofthe service providers or users.

The user's stored data can include personal and financial dataassociated with a specific natural person, such as a name, a useraddress (e.g., a postal address), a phone number, an e-mail address, acredit card number, credit card expiration date, a bank account number,a bank routing number, a social security number, a driver's licensenumber, an identification number, a place of birth, a date of birth, amother's maiden name, and any other personal identification informationrelevant to the user-service provider relationship. Data can alsoinclude preference data, such as at least one shopping profile, at leastone music profile, at least one banking profile, and other data thatindicates the user's preferences for transactions, vendors, products, orservices of various kinds as well as historical data representing theperson's status in a loyalty program or other indicia of the person'sprevious transaction history with a given service provider.

In various embodiments, discussed below, a user identification code(user ID) and service provider identification code (service provider ID)are used in retrieval of data from the dispersed data storage system216. Preferably, these codes are not known to the A&DDS managementsystem 204 on a permanent basis. Instead, they become known (if at all)only during an authentication phase while the user and service providerare being authenticated.

In embodiments, all data are dispersed in accordance with a selectedinformation dispersal algorithm over multiple dispersed and networkeddata storage locations 218 in such a way that it is not possible toreconstruct the whole record or part of it from less than somepredefined minimum number of data storage locations 218. Informationdispersal algorithms are discussed in more detail below.

As one means to authenticate a particular user, the system makes use ofportable devices such as hardware identification tokens 27 which holdthe aforementioned user ID and one or more data encryption keys. Inexemplary embodiments any cryptographic calculations are performed andprotocols reside in the token 27 itself rather than in the userterminal/token interface 222. The user terminal/token interface 222 onlyhelps to pass messages to/from the token 27 and other components in thesystem. This approach allows any suitably configured user terminal, notnecessarily only trusted terminals, to be used in the system since allsecure elements are in the token 27, which is produced in accordancewith established security measures known in the art for both hardwareand software. The system is thus very secure and mobile, i.e., the token27 can be used with a wide array of user terminal/token interfaces 222such as unsecure computers, pay terminals, etc.

As a result of both service provider and user authentication, the systemcan obtain a data container identifier, corresponding to data stored ina data container associated with the authenticated user/service providerpair. This data container identifier is used by the system to retrievethe data container from the secure data storage of the system and isdiscussed in more detail below.

One advantageous feature of the system is that every act of user/serviceprovider authentication involves the generation of a temporarytransaction identifier (“ticket”) which is unique in time and space. Theticket allows the system to associate a user with a service providerduring a given transaction. The system knows to whom it issued theticket and learns the identity of party that returns the ticket to thesystem. A ticket's life cycle starts when either side (user or serviceprovider agent 220) requests a new ticket and ends when the other side(service provider agent 220 or user respectively) produces this ticketback to the system. The association between the service provider and theuser is established when the ticket circulates through the system. Forexample, if a user (through the token 27) initiates the transaction byrequesting a ticket, then the ticket traverses the following circularpath: The user front end 208 of the A&DDS management system 204→token27→service provider agent 220→service provider front end 205 of theA&DDS management system 204→user front end 208 of the A&DDS managementsystem 204. Conversely, if a service provider (through the serviceprovider agent 220) initiates the transaction by requesting a ticket,then the ticket traverses the following circular path: service providerfront end 205 of the A&DDS management system 204→service provider agent220 token 27→user front end 208 of the A&DDS management system204→service provider front end 205 of the A&DDS management system 204.

The ticket may carry various information. In embodiments, thisinformation is a combination of human-readable service provider name,network node address from where this ticket was issued, and a nonce(number used once) based on a random number.

The security of data is ensured via a number of measures. First, inembodiments, necessary user access and encryption keys are kept only onportable tokens 27. Most of this information is not known to the A&DDSmanagement system 204 on any permanent basis (i.e., the data are notstored on hard disks or other kind of non-volatile memory). For userauthentication to be successful, mutual authentication (e.g.,authentication of the token 27 and service provider agent 220, as wellas authentication of the A&DDS management system 204 to the token 27 andservice provider agent 220) is employed.

The token 27 preferably is a physical object such as a hardware token oran embedded token, containing a computer chip, integrated circuitry,smart card chip or software, or combination thereof. If token 27 is ahardware token, it preferably takes the form of a ring or other jewelry;a dongle; an electronic key; a card, such as an IC card, smart card,RFID or proximity card, debit card, credit card, ID badge, securitybadge, parking card, transit card; or the like.

If the token 27 is an embedded token, it preferably takes the form of acell phone; a personal digital assistant; a watch; a computer; computerhardware; or the like. The token 27 preferably includes an input/outputsupport element or a device interface that may take the form of anynumber of different apparatuses, depending upon the particularapplication in which it is used and depending upon the type of devicewith which it interacts. In embodiments, the input/output interfaceincludes a port, such as a wireless communications port (e.g., NearField Communication (NFC) interface), a serial port, a USB port, aparallel port, or an infrared port, or some other physical interface forcommunicating with an external electronic apparatus, whether by contactor contactless method.

Second, in embodiments, each service provider is registered in the A&DDSmanagement system 204 in the same way as private users, i.e. all serviceproviders are given a unique service provider ID and correspondingaccess keys and encryption keys. The service provider must pass mutualauthentication procedures before being provided access to data.

Third, in embodiments, the user ID and service provider ID pair, madeknown during the authentication process, are used to form a datacontainer identifier that identifies a data container in the disperseddata storage system 216. This data container holds data that aparticular service provider is allowed to access, use and/or modify. Thedata container can be analogized to a safe deposit box where two keysare needed to open it—one belongs to a bank, the other to the client.Each relationship that a user has with a service provider is associatedwith its own data container since all service provider id/user ID pairsare unique.

Fourth, in embodiments, to provide reliable storage of data containersthe system adds some redundancy information and scatters the data overmultiple dispersed and networked data storage locations 218. When datais read back, the combination of the user ID and service provider ID areused to identify a particular set of data storage locations 218 and theway to restore the integrity of the data container. Dispersed datastorage is preferred for most applications but is not a requirement ofall embodiments of the invention.

Fifth, in embodiments, the use of redundancy information ensures that itis still possible to reconstruct a data container in the event that somedata storage locations (i.e., not more than some predefined minimumnumber of them) become non-functional.

Sixth, in embodiments, data containers are ciphered (e.g., encrypted) bysecret keys, which become known as a result of user authentication. Inaddition, data containers may be ciphered (e.g., encrypted) by theservice provider secret keys.

Seventh, in embodiments, as mentioned above data containers can beidentified by a unique combination of user ID and service provider ID.However, if the data container identifier is a mere concatenation ofthose IDs, there may be potential security issues. For example, a personhaving an access to a full list of available data containers can findall the data associated with a particular user ID. To avoid thispossibility the combination of user ID and service provider ID istransformed by a one-way function to produce the data containeridentifier so that it is not possible (in any practical sense) torestore either the user ID or the service provider ID from resultingdata container identifier.

System from the User Point of View:

From the user point of view, user authentication is based on at leastthe “what somebody has” principle using the token 27. As describedabove, the token 27 is preferably a small electronic device that theuser has at his disposal. FIGS. 8A through 8D illustrate just some ofthe many possible embodiments of a token 27. From the user's point ofview, the token 27 is a universal key that opens many doors (i.e., itcan be used to authenticate the user to many different serviceproviders).

For applications of a token requiring high security, the token—or thetoken in combination with an input/output element—may include thefollowing components: a keypad (alphanumeric), interactive display, orother type of data entry mechanism (collectively referred to herein as“user interface”) that allows a user to compose or modify a message; auser interface for inputting data representing a secret (it should benoted that the user interface for generating or modifying a message may,but does not have to, be the same as the user interface for the entry ofthe data representing a secret); a display for showing the messageand/or secret to the user; a scanner or reader for receiving at leastone type of biometric data for a biometric characteristic of the user;memory for securely storing a secret of the authorized user, biometricdata of the authorized user, and/or other security information; aprocessor or circuitry for verifying input of the secret or biometricdata as being that of the authorized user; a processor or circuitry forgenerating or originating digital signatures; and/or an output foroutputting from the device and transmitting information including themessage and digital signature therefor. Preferably, the device alsoincludes memory for storing and exporting encryption key(s), a token ID,a user ID, and other information. For lower security applications, notall of the above elements are necessary.

In certain embodiments, the token is smart enough to ask for a secondkind of authentication criteria, such as a “what you know” authenticator(e.g., PIN) for critical applications and to display a service providername during the authentication process.

FIG. 8A is a block diagram of the functional components of the token 27.The heart of token is the secure element 310, which includes amicroprocessor, memory (e.g., random-access and read-only memories) foroperating instructions and data storage, and input/output interfaces.The microprocessor operates in accordance with a program resident in itsmemory. As discussed in detail in the following sections, every token 27has stored in its memory a token ID, a token key, a user ID andoptionally a data encryption key. The token ID is a unique numberassigned to this token and known to the A&DDS management system 204. Itis not a secret parameter and is used for authenticating the token 27.

The token key is a secret parameter. This token key is also known to theA&DDS system. This token key is used for token-to-system mutualauthentication and creation of a ciphered (e.g., encrypted)communication channel between the system and the token.

The user ID is the most sensitive parameter stored in the token. Thisuser ID is used to derive a data container identifier used in retrievalof the user's stored data. If sent outside of the token at all, itshould only be sent to the A&DDS system via a ciphered (e.g., encrypted)channel.

The data encryption key is optional and used in some applications wheredata may (and preferably is) encoded/decoded by the token. For example,a user could use the A&DDSM system for password storage or storage ofother personal data. The user accesses this data through a user terminal108, 110. When retrieved from the A&DDSM system, the user terminal canpass the retrieved data to the token for decryption and return to theuser terminal for viewing and/or editing the data, and pass the databack through the token for encryption before transmission back to theA&DDSM system for storage.

In another example, the token may generate a unique file encryption key.The token gives this file encryption key to the user terminal 108, 110so that the user terminal 108, 110 encrypts data to be stored in theA&DDS management system 204. The token encrypts the file encryption keyand, optionally, an indication the encryption algorithm used with thedata encryption key and then causes these encrypted data to be stored inthe A&DDS management system 204.

The architecture of the secure element as well as its software ensurethat the token key (and, in some cases the data encryption key) cannotbe exported from the token memory. They also ensure that the user ID maybe transmitted only via ciphered channel.

One possible implementation of the secure element 310 is a cryptographiccard. Available cards can communicate by a legacy ISO-7816 contactinterface, a contactless interface (e.g. ISO 14443) or a USB interface(or any combination of these interfaces). In some cases the secureelement 310 may have a single wire protocol interface for communicationwith an external contactless transceiver. This secure element may bepackaged in an ID-1 plastic body (e.g., the well-known bank card body)or may be included in a SIM card, which has a secure microprocessor andmemory, as used in mobile phones. Alternatively, the secure element maytake the form of a packaged die with pins for soldering (or otherconnection) to an appropriately configured token body with interfaceconnections for power and communications.

The simplest form of token is an ID-1 smart card which connects to acomputer via USB interface or via a card reader. In that case it isresponsibility of software at a user terminal 108, 110 to show a serviceprovider name and accept user consent for authentication (described invarious embodiments below).

Some embodiments may allow for the secure element 310 to have its ownuser interface 320, i.e. display, buttons, touch screen, and the like.This solution is preferred as it does not depend on any software at theuser terminal 108, 110.

If the secure element 310 does not have its own user interface 320, itmay be embedded in a housing, e.g., a MP3 player, personal dataassistant, or mobile phone, that provides its own user interface 340 aswell as its own communications electronics 330 for communicating with anexternal user terminal (e.g., card reader or computer). Some mobilephones, personal data assistants and the like may already includecomponents 310, 330 and 340. The token functionality could then beimplemented in an application of the device. The secure element 310 maybe a 3G mobile phone multi-application SIM card or specially installedsecond cryptographic element. Any number of interfaces (e.g. Bluetoothor USB) may be used to connect the device to the user terminal 108, 110.

The user terminal 108, 110 may include, if necessary, software forrouting various communications between the browser resident on the userterminal 108, 110, the user front end 208, and the token 27. Thissoftware can be permanently resident on the user terminal, such as inthe form of a browser plug-in, or in form of drivers or executableprograms, including programs running as a service (daemons). Some partsof user terminal software may be downloaded each session as, forexample, an applet. A servlet based approach may also be used.

FIG. 8B illustrates a basic smart card or fob token 224A. The token 224Aincludes an input/output interface 225, such as a USB connector, forconnection to a user terminal/token interface 222, which may be either aspecialty terminal (such as a point of sale terminal of a merchant)located at the service provider premises or the user's computer, whichin turn has Internet access. Instead of or in addition to a wiredinterface such as a USB interface, the token 224A can have a wirelessinterface for connection to a suitably configured user terminal/tokeninterface 222. In embodiments, the token 224A may also include a consentbutton 227.

FIG. 8C illustrates an alternative embodiment of a token 224B. The token224B has a user interface including a screen or display 229 and inputbuttons 231. The token 224B also includes a wireless communicationsinterface (illustrated by wireless communications 233), such as anInfrared Data Association interface, contactless NFC interface, orBluetooth interface.

FIGS. 8D and 8E illustrate that token functionality may be incorporatedinto mobile phones 224C and 224D as applications resident on the phones.In the embodiment of FIG. 8D, the mobile phone 224C can be connected toa wired interface such as a USB port of a user terminal/token interface222 by a wired connection 235. Alternatively, in the embodiment of FIG.8E, the mobile phone 224D can communicate with the user terminal/tokeninterface 222 wirelessly (as illustrated by wireless communications237), such as by way of NFC, Bluetooth, SMS/GPRS/3G or other appropriatetechnology.

In order to authenticate a user accessing the website of a particularservice provider, or to authenticate the user at a service providerpremises (e.g., at a point of sale terminal), the user connects histoken 27 to a user terminal/token interface 222. The user presses abutton on the token 27 to confirm that the user seeks to beauthenticated to the service provider. In embodiments, the consentbutton could be implemented as a soft button on the display of the userterminal. As a result of token authentication and service providerauthentication (the processes of which are described in detail below),the service provider is provided access to the data needed by theservice provider for interaction with the user. This data (e.g., acustomer profile) are retrieved from the dispersed data storage system216, assembled and sent to the service provider agent 220. The dataallows the service provider to know, for example, how to address theuser, how loyal the user is and what kind of discounts should beprovided. The service provider can modify the data and send it back tothe A&DDS management system 204 for safe storage in the dispersed datastorage system 216. Sensitive data are not maintained at the serviceprovider agent or associated data storage and thus are not as vulnerableto inappropriate access.

As noted above, the functionality of the system is similar to that of asafe deposit box. Data are stored in the virtual safe deposit box. Toopen the box two keys are needed: one from the user and one from theservice provider. Once the box is open, the service provider and/or theuser obtains the data and uses it in a current session. When the sessionis over, the service provider and/or user may put modified data backinto the safe deposit box or return the box with the content unmodified.

It is important to note that each safe deposit box or “data container”contains only data relevant to a particular user/service provider pair.This data is generated as part of, for example, the user's registrationat a service provider's website or at the time of issuing a loyalty cardand may be updated as the relationship with the user progresses toreflect the user history with the provider. By registration it is meantan operation in which a user provides identity information to a serviceprovider in order to establish a permanent business relationship withthe service provider; thereafter, the service provider recognizes theuser through some form of authentication credentials. Data for anotherservice provider is stored in a separate data container and areavailable only to that particular service provider.

System from Service Provider Point of View:

To use the A&DDS management system 204 for third-partyidentification/authentication and for safe private data storage, theservice provider must first register with the A&DDS management system204. The service provider is assigned a service provider ID and one ormore keys for authentication and traffic ciphering (e.g., encryption).These keys and service provider ID can be provided in the form of tokensthat are installed on the service provider's servers, such as at the USBport of the servers. If the service provider uses a hosting service asits service provider agent 220, then this information can be providedas, for example, a software token to the hosting service. Any necessarysoftware is then installed at the service provider agent 220 forenabling this kind of third-party identification/authentication. Forexample, the software may include, generally speaking, a libraryanalogous to what is provided by the OpenID Foundation for those webentities using their authentication system. The library is installed onthe server and modifications are made to the service provider'sfiles/programs to call this library's procedures for userauthentication/database requests. By way of example, the Apache webServer, which is the most widely used server today, is configured to beable to use external modules for authentication. Module names start withmod_auth_method, where method is the name of the authentication method.This module can be provided for use by a service provider server. Theservice provider may choose to trust the A&DDS management system 204with storing data associated with a specific user. Alternatively, incases where the service provider already has a large investment in areliable database and does not want to redesign its core technologies,it is possible to store within the dispersed data storage system 216only certain pieces of information, such as the service provider's localID that it associates with the presented user. It should be understoodthat this form of data need not necessarily be, but may be, stored in adispersed format. No matter which kind of service is chosen, the userexperience will be the same.

If the service provider interacts with the user through a webpage, theservice provider preferably modifies its login webpage to add anappropriate graphical symbol, textual prompt (analogous to the OpenID orMicrosoft LiveID) single sign-on service symbols) or button that allowsa user to authenticate himself/herself using the token 27. When the userpresses on the button or points-and-clicks the graphical symbol, a newgraphical user interface (e.g., webpage) may be displayed to the user. Aticket is created and used in the authentication process ofauthenticating both the user and/or the service provider (described inmore detail below). The ticket is issued by the A&DDS management system204 and passed between the user terminal/token interface 222 and theservice provider agent 220. This new graphical user interface promptsthe user to plug-in (by wired or wireless connection) his token 27 andactivate the token 27 (e.g. press the consent button 227 in theembodiment of FIG. 8B). When the user activates the token 27, a newauthentication transaction begins and if authentication is successful,the service provider agent 220 receives the stored data from the A&DDSmanagement system 204. For example, the service provider agent 220 canreceive all the information about a particular user that has beengathered to date by the service provider, e.g., the user informationthat was gathered during initial user registration with this serviceprovider along with historical data (e.g., purchase or other transactionhistory, etc.). If the service provider had chosen to keep all data inits own database, then the retrieved data may carry only a pointer (orreference, or key) to the user record, such as in the form of a useridentifier used in the database system accessible to the serviceprovider agent 220.

FIG. 9 is a schematic illustration of the user front end 208 of theA&DDS management system 204. The user front end 208 preferably takes theform of a computer program that runs on a networked computer. Thiscomputer has a processor, random access memory, a number of networkinterfaces and a mass data storage device (e.g., hard disk drive). Ifthis computer is used solely for the purpose of user front endfunctionality, then data stored on a hard disk includes principallyoperating system files and the user front end program. The user frontend 208 also includes configuration data, which is used to discoverother components of the A&DDS management system 204 (e.g., disperseddata storage management system 210, service provider front end 205 andkey management system 212), to the extent those other components areresident on other networked computers/processors forming the A&DDSmanagement system 204 or at other IP addresses in a network (virtual orotherwise). From a network point of view, the user front end 208 uses IPfor communications with other devices and has three principal connectionpoints. The first connection of interest is the connection 239 from theuser terminal/token interface 222 to the user front end 208 as a tokenserver. This token server has a public IP address and is the entry pointfor all authentication operations with user terminals/token interfaces222. Those operations may arrive from all over the world. The user frontend 208 has another IP connection 241, which is a connection point tothe dispersed data storage management system 210. The user front end 208uses this connection 241 to read data containing token keys for mutualuser front end/token authentication. This connection is an intra-systemconnection and may have an internal system IP address (e.g., an addressinside a virtual private network). Finally, the user front end 208 has aconnection 243 to exchange data (e.g., tickets, user IDs or otherinformation) with the service provider front end 205. This connectionmay also use an intra-system network connection through, for example, avirtual private network.

The user front end 208 is responsible for authentication of the userusing a token 27. Authentication is based on a unique token number andthe user front end's knowledge of a token key that is a secret. Thetoken key (as well as enabled/disabled state and other possibleparameters) may be stored in an external data storage system, such asthe dispersed data storage system 216 managed by the dispersed datastorage management system 210. This option allows the user front end 208not to keep records describing tokens in its memory or attached massdata storage devices. After successful authentication the token 27 sendsanother secret datum: the user ID, which is a unique number stored onthe token 27 and used in data retrieval from the dispersed data storagesystem 216. The user ID should not be confused with a token ID, which isanother ID stored on the token but not used in connection with a serviceprovider ID for retrieval of a data container.

When the user front end 208 receives this user ID, it generates atemporary data structure 245 in its random access memory. The datastructure 245 can be used as a way to supply the service provider frontend 205 with the data contained therein. This data structure 245 holdsinformation on a newly created transaction:

-   a) a unique identifier of the transaction (ticket) which preferably    includes a random number and the network address of the user front    end 208;-   b) the user ID; and-   c) a data encryption key (optional).

Every transaction is assigned a time-to-live parameter, which representsthe maximum time period the transaction may be kept in the memory of theuser front end 208. Regardless of the time-to-live parameter, the datastructure 245 can be used as a means to supply the service providerfront end 205 with the data contained therein.

FIG. 10 is a schematic illustration of the service provider front end205 of the A&DDS management system 204. The service provider front end205 preferably takes the form of a computer program that runs on anetworked computer. This computer has a processor, random access memory,number of network interfaces and mass storage device (e.g., hard diskdrive). If this computer is used solely for the purpose of serviceprovider front end functionality, then data stored on a hard diskincludes principally operating system files and the service providerfront end program. The service provider front end 205 also includesconfiguration data, which is used to discover other components of theA&DDS management system 204 (e.g., the dispersed data storage managementsystem 210 and the user front end 208), to the extent those othercomponents are resident on other networked computers/processors formingthe A&DDS management system 204 or are located at another IP address.From a network point of view, the service provider front end 205supports IP communications and has three connections. The firstconnection 247 is an access point for service provider agents 220. Thisconnection 247 is preferably by way of a public IP address and is usedfor all exchanges with service provider agents 220. The service providerfront end 205 has a second connection 251 for communicating with thedispersed data storage management system 210. The service provider frontend 205 uses this connection to receive/send data containers containingdata to the dispersed data storage management system 210. Being anintra-system connection, this connection 251 may have an internal systemIP address, for example an address inside a virtual private network.Finally, the service provider front end 205 preferably has a thirdconnection 249 for exchanging data (tickets, user IDS or otherinformation) with the user front end 208. This connection may also usean internal system IP address, for example an address in a virtualprivate network.

The service provider front end 205 can be considered a socket in theA&DDS management system 204 to which a service provider agent 220connects in order to obtain data from or submit data to the system. Theservice provider front end 205 is responsible for authentication ofservice provider agents 220, ticket transfer and data exchange betweenthe A&DDS management system 204 and the service provider agents 220. Inembodiments described more fully below, when the service provider frontend 205 receives a ticket from a service provider agent 220, itcalculates a network address of the user front end 208 that issued theticket and then requests the user ID and (optionally) data encryptionkey from the user front end 208. Next, the service provider front end205 combines service provider ID and user ID, and obfuscates thiscombination to obtain a data container. A service provider agent 220requests the A&DDS management system 204 to execute a particularoperation (e.g., CREATE, READ, WRITE or DELETE) on the data container.In the case of a CREATE operation, an empty data container may becreated. When it is a READ operation, the data container is provided bythe dispersed data storage management system 210 to the service providerfront end 205, optionally decrypted with a data encryption key, and sentto the service provider agent 220.

For WRITE operations, the service provider front end 205 receives datafor reliable storage from service provider agent 220. The serviceprovider front end 205 optionally encrypts this data with a dataencryption key and sends the data container to the dispersed datastorage management system 210 for storage. A DELETE operation requeststhat the dispersed data storage management system 210 destroy a datacontainer.

FIG. 11 illustrates in more detail the dispersed data storage system 216and its connections. The dispersed data storage system 216 is used inthe system to keep two kinds of system resources: (i) data containershaving token secret keys and token status, and (ii) data containershaving other data.

All data containers are identified by a data container identifier (i.e.,file name) that is derived with an algorithm based on a combination ofunique identifiers in the system, namely (in the case of a datacontainer having other data) the user ID and service provider ID. Othervalues may also contribute to the combination. This combination isobfuscated by one-way function. A one-way function is a function that iseasy to compute but whose inverse is very difficult to compute. Theone-way function generates the data container identifier that is used toretrieve a data container from the dispersed data storage 216. Thepurpose of obfuscation is to make it impossible (in any practical sense)to restore the user ID and/or service provider ID from the datacontainer identifier.

In one exemplary embodiment, the obfuscation uses a RSA encodingprocedure with a known public key. In cryptography RSA is an algorithm,named after its inventors (Rivest, Shamir and Adleman), for public-keycryptography. RSA is widely used in electronic commerce protocols, andis believed to be secure given sufficiently long keys. RSA uses a publickey and a private key. The public key can be known to anyone and usedfor encrypting messages. Messages encrypted with the public key can onlybe decrypted using the private key. The public key consists of themodulus n and the public (or encryption) exponent e. The private key,which must be kept secret, consists of the modulus n and the private (ordecryption) exponent d. The A&DDS system generates a public/private keypair. The public key is stored at the location in the system responsiblefor generating the data container identifier (e.g., token 27 or theA&DDS management system 204 depending on the embodiment). The privatekey is destroyed, deleted, or set aside in highly secure data storagefor data recovery in case of disaster. In order to derive the datacontainer identifier, the user ID and service provider ID are firstconcatenated. That is, for illustrative purposes only, if user ID is (inbinary) 0110 and the service provider ID is 1110, then the concatenation

-   -   user ID|service provider ID=01101110        where “|” represents the concatenation operator. This        concatenation is then encrypted with the public key, i.e.,    -   data container identifier=[(user ID|service provider ID)^(e)]        modulus_(n)        The public key encryption acts as a one-way function since the        private key is unavailable to decrypt the data container        identifier to reveal the user ID and service provider ID.

The dispersed data storage system 216 includes multiple dispersed andnetworked data storage locations 218. The dispersed data storagemanagement system 210 preferably includes one or more data collectors242. The data storage locations 218 are networked computers equippedwith hard disks; e.g., solid state disk drives. Their primary task is topermanently store data. A data collector 242 receives requests from theuser front end 208, the service provider front end 205 and the keymanagement system 212. Those requests are to create, read, write, ordelete a data container specified by its data container identifier. Incertain embodiments, the resources are stored in a dispersed manner inaccordance with an information dispersal algorithm. When data is stored(a write operation) in the system, a data collector 242 executes theinformation dispersal algorithm to convert the data into a plurality(e.g., 10-20) of data segments and calculated derivatives thereof (forredundancy) and sends each segment to a separate data storage location218. To execute a read request, a data collector 242 first collects thecorresponding segments from the data storage locations 218, and, in caseone or more data storage locations 218 fail, a data collector 242obtains segments from other data storage locations 218 for theirsegments. The intrinsic redundancy of the information dispersalalgorithm is used to preserve data and can also be used to check fordata errors.

Various information dispersal algorithms may differ in particulardetails, such as the matrix and arithmetic used, and whether theinformation dispersal algorithm tries to identify errors itself or inreliance on some other data. But information dispersal algorithms tendto work in the same way. The operation of an information dispersalalgorithm can be illustrated by the following examples. Assume a longnumber such as 12345678 is to be stored in a dispersed manner. To storethe number safely, it is divided into two halves: 1234 and 5678. Thefirst half (1234) is stored at a first data storage location (location#1) (e.g., first data server). The second half (5678) is stored at asecond data storage location (location #2). Next, some derivative of thehalves is calculated, such as the sum of the halves, 6912 in thisexample. This derivative is stored at a third data storage location(location #3). With this approach, any one of three data storagelocations can be lost/corrupted/unavailable and the original data can berestored from the remaining two locations. For example, if location #1is down, the original data can be restored using the values in location#2 and #3: the data in location #1 is restored by subtracting the datain location #2 from the data in location #3. Likewise, if location #2 isunavailable, its data can be derived by subtracting the value inlocation #1 from the value in location #2.

By increasing the storage 1½ times (when compared to simply storing 1234and 5678 in two locations), the original information is recoverable iftwo data storage locations are available. It is noted that the use ofderived redundancy segments also reduces the data storage requirements.If pure mirrored redundancy were used, four data storage locations(i.e., two locations for storing 1234 and two locations for storing5678) would be required. Further, while using more data storagelocations (four rather than three), not all combinations of locationscan be used to restore the original data. For example, the original datacannot be restored from two locations having stored therein 5678.

The above-described three location redundancy scheme can be modeled as(m,k)=(2,1)m+k=n=3where m represents the size (in segments) of the original data and theabsolute minimum number of segments required to restore information, krepresents the redundancy data (i.e., the number of segments of datathat can be lost), and n represents the total number of chunks.

Even better results can be obtained if a fourth data storage location isadded for storing the difference between the data in the second andfirst locations, i.e.,4444=5678−1234The data storage is double that used when merely storing the data in twolocations; but, any two segments of data can be used to restore theoriginal information, even if none of the segments containing original(i.e., non-derived) data portions (e.g., 1234 and 5678) is available.For example, if both location #1 and location #2 are unavailable, thecontent of these locations, and thus the content of the original data,can be restored from location #3 and location #4, i.e.,

$\begin{matrix}{{{{contents}\mspace{14mu}{of}\mspace{14mu}{location}\mspace{14mu}{\# 1}} = \frac{{{location}\mspace{14mu}{\# 3}} - {{location}\mspace{14mu}{\# 4}}}{2}}{{{contents}\mspace{14mu}{of}\mspace{14mu}{location}\mspace{14mu}{\# 2}} = \frac{{{location}\mspace{14mu}{\# 3}} + {{location}\mspace{14mu}{\# 4}}}{2}}} & \;\end{matrix}$Moreover, if an individual location is still responding but returnscorrupted data instead of the real information, this can be detected andthe original data restored.

This redundancy scheme can be modeled as(m,k)=(2,2)where

-   -   k=2    -   m=2    -   n=4        Using four data storage locations, any two can be lost and the        remaining two can be used to restore the original data.

In an exemplary embodiment the information dispersal algorithm used bythe system to store the data in dispersed form is the Reed-Solomonalgorithm and further elaborated in U.S. Pat. No. 005,485,474 Scheme forInformational Dispersal and Recostruction [1996]. From a very high leveland simplified perspective, the Reed-Solomon algorithm works inaccordance with the foregoing description, though using Galua fields andpolynomial algebra. The algorithm breaks the original data into multipleparts or chunks and provides data redundancy, as opposed to simplymirroring the original data (i.e., storing the same part of datamultiple times). The algorithm conforms to the (m, k), m+k=n schemedescribed above. That is, there are n locations, and at least any m ofthem can be used to recover the original information. There are kadditional locations for redundant data. Errors totaling k/2 can also bedetected and corrected when k/2 locations appear functional at firstglance but actually provide corrupt data.

In exemplary embodiments the information dispersal algorithm has 12locations and conforms to a (6, 6) scheme. However greater or lessredundancy can also be built in, such as (6, 12) and (8, 16) schemes.

Another way to protect the data is to cipher (e.g., encrypt) them with asymmetric key. The key may be calculated as a hash of a concatenateduser ID and service provider ID. This encryption operation isindependent from that undertaken with the token's data encryption key.

The data storage locations 218 are preferably dispersed over predefinedzones 240 ₁ to 240 _(n), where n is preferably three or more, in such away that it is impossible to restore data from the data storagelocations 218 belonging to a single zone 240. On the other hand, itshould be possible to restore data even in case a whole zone 240 of datastorage locations 218 is nonfunctional. For a (12, 6) informationdispersal algorithm the latter condition may be met by three zones 240with four data storage locations 218 each. For a (16, 8) informationdispersal algorithm six, five, and five data storage locations 218 arerequired in three different zones.

FIG. 12A is the message sequence diagram for user authentication at aparticular service provider agent 220 where the ticket is issued by theuser front end 208. In the authentication method illustrated by thesequence diagram of FIG. 12A, the token 27 starts the process, askingfor a new ticket from the user front end 208. The user front end 208logically links the ticket and user ID. The token 27 sends the ticket tothe service provider agent 220. Then, the ticket is produced to theservice provider front end 205. The service provider front end 205obtains the location address of the ticket issuer (i.e., of the userfront end 208). The service provider front end 205 then obtains the userID. It is now possible to retrieve corresponding data. The serviceprovider front end 205 links both user and service provider IDS andoptionally other codes and asks the dispersed data storage managementsystem 210 for the data that corresponds to this pair. Finally the datais collected by a data collector 242 and sent to the service provideragent 220.

As a more detailed example of user and operation, with specificreference to FIG. 12A, the process starts when the user presentshimself/herself to a service provider, such as when the user accessesthe webpage of a service provider agent 220. The user is prompted toauthenticate using the token 27. For example, one way to prompt the useris to send a webpage with a HTML form in it to the user terminal/tokeninterface 222. The user connects the token 27 to the user terminal/tokeninterface 222 (via, for example, a USB port, a contactless reader, or bytaking appropriate steps with the user's mobile phone) and presses thesoft or hard consent button. The token 27 then starts the process ofmutual authentication with the user front end 208. The token 27 sendsand receives messages to/from the user front end 208 via the userterminal/token interface 222. The authentication and data retrievalsequence described below follows.

For communications between the token 27 and the user front end 208, anynumber of standard mutual authentication algorithms may be used, such asthose explained in the ISO/IEC-9798 specification, the entirety of whichis hereby incorporated by reference herein. The details of this mutualauthentication are not described herein so as to avoid unnecessarilyobscuring the details of the present invention. Only a very high levelillustration of this authentication procedure is discussed below inconnection with messages 701 through 709, with certain features uniqueto the present system also described in connection therewith.

Every token 27 uses its own authentication key, known to the A&DDSsystem. An essential part of any authentication is the sending of thetoken ID from the token 27 to the A&DDS system. This is shown at message701 where the token 27 sends its token ID (which is not to be confusedwith the user ID) to the user front end 208.

The A&DDS management system 204 stores some information about each tokenthat it creates. This information includes at least a token state(enabled or blocked) and a token key for use in token authentication.This information is stored in a data container in the same disperseddata storage system 216 as the other data (i.e., as the data containersassociated with a user/service provider pair). Therefore, a datacontainer identifier is used to retrieve this information from thedispersed data storage system 216. The user front end 208 has the tokenID (from message 701) and some predefined number TSPID, which serves asa virtual service provider ID. Essentially TSPID is a system ID that isused in combination with any given token ID for purposes of deriving adata container identifier. The user front end 208 uses both identifiersto calculate a data container identifier for the data container havingthe token information described above for the presented token 27. Inexemplary embodiments this data container identifier is derived by usingthe TSPID and token ID as inputs to a one-way function

-   -   data container identifier=ƒ_(one-way)(TSPID, token ID)        At message 703, the user front end 208 sends this data container        identifier to the dispersed data storage management system 210        with a READ request shown as READ(data container identifier)        which equates to READ(ƒ_(one-way)(TSPID, token ID)). Passing the        data container identifier queries the dispersed data storage        management system 210 for the information on (i) whether this        token ID is registered in the system and is active (i.e., not        blocked or deactivated) and (ii) the cipher keys associated with        the token.

The system does not use a single master key, a technique by which apublic token number, stored on the token, is combined with a secretsystem-wide private number (the master key) in a one-way function toyield a public result that is also stored on the token, and by which anydevice knowing the master key and the one-way function may verify theauthenticity of the token. Therefore, there is no master key that can bestolen and used to compromise the system. Rather, separate symmetrickeys (e.g., cryptographic keys and optionally identification of thecryptographic algorithm) are used for each token 27 issued by thesystem. Even then, these keys are not stored in a single place. Rather,the keys are dispersed over the dispersed data storage system the sameway data (i.e., data containers storing data) are stored in the system.

The dispersed data storage management system 210 uses the data containeridentifier to retrieve the data container containing the token's secretkey(s) and status from the dispersed data storage system 216. At message705, the data container is sent to the user front end 208. The use of“key(s)” illustrates that a single key can be used to encryptcommunications back and forth between the user front end 208 and thetoken 27, or separate keys can be used for encrypting communications tothe user front end 208 and from the user front end 208,

At this point, the user front end 208 continues the authenticationprocess, which normally results in generation of a session key or keys,which will be used to encrypt all subsequent messages between the token27 and the user front end 208 during this session. As determined by theauthentication algorithm that is employed, the token 27 and the userfront end 208 exchange messages to complete the mutual authentication.This exchange for completion of the mutual authentication is shown asmessages 707 in FIG. 12A. A session key is derived from symmetricauthentication keys and random challenges exchanged duringauthentication

At encrypted message 709 the token 27 uses the session key to encryptthe user ID it has stored in its secure data storage and (optionally) adata encryption key, and then sends them to the user front end 208. Theuser front end 208 decrypts this message and creates and stores in itsrandom-access memory a data structure 245, which describes thisauthentication process. This data structure holds the user ID and theoptional data encryption key along with a ticket. In embodiments, theticket is an identifier of the transaction that is unique in time andspace. For example, the ticket can be a string of ASCII or UTF-codedsymbols including a temporarily unique-for-this-user front end randomnumber, the user front end network address (possibly a local virtualprivate network address) and optionally some other helper information.

It should be understood that message sequence 701 through 709illustrates only one possible message sequence for mutual authenticationbetween the token 27 and the A&DDS management system 204. Otherprocedures can be employed, such as those used by the various smartcards available on the market.

At encrypted message 711 the user front end 208 sends the ticket overthe encrypted channel to the token 27.

At message 713 the token decrypts the ticket and passes it to the userterminal/token interface 222, which in turn sends it to service provideragent 220. For example, the user terminal/token interface 222 may insertthe ticket into the service provider agent's HTML form and then returnthe form to the service provider agent 220.

At message 715 the service provider agent 220 connects to the serviceprovider front end 205, and sends the ticket to the service providerfront end 205. Service provider agents 220 can be considered to havemore or less a permanent connection to the A&DDS management system 204.In this situation, the service provider front end 205 already has theservice provider ID. If there is no such permanent connection, theservice provider agent 220 and service provider front end 205 performmutual authentication and session key generation as discussed above inconnection with authentication of the token 27 and the user front end208. In this manner, the service provider ID is revealed to the serviceprovider front end 205.

At message 717 the service provider front end 205 receives the ticketand obtains the network address of the issuing user front end 208 fromthe ticket. The service provider front end 205 then sends the ticket tothe so-identified user front end 208, requesting the user ID and,optionally, the data encryption key.

At message 719, the user front end 208 finds the data structure 245associated with the ticket received from the service provider front end205 and replies to the service provider front end 205 with the user IDand data encryption key. After this data is transmitted to the serviceprovider front end 205, the data structure 245 can be deleted from therandom access memory of the user front end 208.

At message 721 the service provider front end 205, which has both theuser ID (from message 719) and service provider ID uses both identifiers(and optionally additional codes) to derive a data container identifier(i.e., the file name of the data container associated with the serviceprovider/user ID pair). In exemplary embodiments this data containeridentifier is derived by using the user ID and service provider ID asinputs to a one-way function

-   -   ƒ_(one-way)(service provider ID, token ID)        as described above. This data container identifier is sent to        the dispersed data storage management system 210 as message 721        READ(data container identifier).

At message 723, using the information dispersal algorithm and datacontainer identifier, a data collector 242 of the dispersed data storagemanagement system 210 gathers enough segments of the data container fromthe dispersed data storage system 216, assembles the data container andsends the data container to the service provider front end 205. Theservice provider front end 205 receives the data container and, ifencrypted, decrypts the data using the data encryption key it receivedfrom the user front end 208 in message 719.

At message 725 the service provider front end 205 sends the datacontainer to the service provider agent 220 in the same form it wasreceived from the service provider agent 220. The data is preferablyencrypted using a session key established by the service provider agent220 and the service provider front end 205 during their mutualauthentication session.

FIG. 12B is message sequence diagram for user authentication at aparticular service provider agent 220 where the ticket is issued by theservice provider front end 205 (as opposed to the user front end 208 asshown in the sequence diagram of FIG. 12A). In this approach, theservice provider agent 220 requests a new ticket from the serviceprovider front end 205. The service provider front end 205 generates anew ticket and assigns it to this particular service provider agent 220.The service provider agent 220 provides this ticket to the token 27. Thetoken 27 in turn authenticates itself according to an authenticationprocedure and produces the ticket to the user front end 208. The userfront end 208 links this ticket with the user ID and sends this linkedticket to the service provider front end 205, which issued the ticket.The service provider front end 205 then links both the user ID andservice provider ID and the dispersed data storage management system 210for the data that corresponds to this ID pair. Finally the data isretrieved and sent to the service provider agent 220.

With specific reference to the information sequence diagram of FIG. 12B,at message 730 the user begins the interaction with the service provideragent 220 by initiating some action that, in the service being providedto the user, requires authenticating the user; e.g., sending an HTTPrequest (e.g., by pressing the image of an HTML authentication button onthe webpage of the service provider agent 220).

At message 732 the service provider agent 220 requests a ticket from itsservice provider front end 205. It is assumed that the service provideragent 220 is already authenticated in the service provider front end205. The service provider front end 205 knows the service provider IDand, therefore, (optionally) a human-readable presentation of theservice provider's name, e.g. “bookstore”. This human readablepresentation, optionally together with a service provider agent-providedpurpose in demanding authentication, may be included in the ticketissued by the service provider front end 205. The ticket issued by theservice provider front end 205 may have, for example, the following formof a universal resource identifier:

-   -   spname: nonce@host: port        where spname is the human-readable presentation of the service        provider (e.g., bank name, airline name, etc.), nonce is a        number used once (e.g., any sequence which makes the ticket        unique), and host:port denotes the Internet address of the        service provider front end 205. In the present example the        ticket may be:    -   bookstore: 687@spfe.net: 4567        Other parameters may also be present in the ticket.

At message 734 the service provider front end 205 sends the ticket tothe service provider agent 220.

At message 736 the service provider agent 220 relays the ticket to theuser terminal/token interface 222, which presents the ticket to thetoken 27. If the token 27 is equipped with a display (see FIGS. 8B, 8C,8D), the token can extract the service provider's name from the ticketand show this name (e.g., “bookstore”) and purpose to the user.Alternately a token 27 without a display may transmit the name andpurpose to the user terminal/token interface 222 for display. This stephelps assure the user that the service provider has been checked andverified by the A&DDS system, and reduces possibilities for phishingattacks.

The user then presses the consent button on the token 27 to start thetoken authentication procedure. Alternately a token 27 without a consentbutton may employ the user terminal/token interface 222 to obtainconsent from the user. The authentication of the token 27 may be thesame procedure described in connection with FIG. 12A at messages 701through 709 (illustrated in FIG. 12B as messages 738). The onedifference is that the ticket is transferred from the token 27 to theuser front end 208 (message 740) as opposed to vice versa onceauthentication has been completed.

At message 742, using the host:port part of the ticket to address thecorresponding service provider front end 205, the user front end 208 nowsends the ticket and user ID (received from the token 27 during messages738) to the service provider front end 205 that issued the ticket.

At message 744 the user front end 208 receives from the service providerfront end 205 confirmation of successful ticket receipt.

At message 746 the user front end 208 relays this confirmation to thetoken 27 via the user terminal/token interface 222.

At message 748 the token 27 sends the confirmation via the userterminal/token interface 222 to the service provider agent 220.

At message 750 the service provider agent 220 sends a request GETDATA(ticket) to the service provider front end 205 for the data. The requestincludes the ticket received with message 734.

The service provider front end 205 receives the data request. Theservice provider front end 205 has the user ID (from message 742) andservice provider ID (received during its authentication procedure withthe service provider agent 220). The service provider front end 205 cancombine both IDs to obtain the data container identifier as discussedabove. At message 752 the service provider front end sends the datacontainer identifier as part of a READ request to the dispersed datastorage management system 210 (i.e., READ(data container identifier)).

At message 754 the dispersed data storage management system 210 uses adata collector 242 to gather and assemble segments of the data containerand sends the assembled data container back to the service providerfront end 205.

At message 756, the service provider front end 205 sends the datacontainer to the service provider agent 220 in the same form it wasreceived from this service provider agent 220; e.g., in encrypted orunencrypted form.

As should be appreciated based on the foregoing description the user IDparameter stored in the token's memory is very sensitive from a securitypoint of view. It is used to retrieve data from the dispersed datastorage system 216. The alternative embodiments discussed below inconnection with FIGS. 12C and 12D allow the user ID to never leave thetoken. In contrast many service providers are associated with publicbusinesses or applications with widespread visibility for whichanonymity is not a concern. In these cases the corresponding serviceprovider ID may not be as sensitive from a generic security point ofview.

FIG. 12C illustrates an alternative embodiment of the message sequencediagram of FIG. 12B. This embodiment provides enhanced protection ofboth the user ID and the service provider ID that are used in derivingthe data container identifier that is used in retrieval of the data bythe dispersed data storage management system 210. This embodiment usesthe nonce portion of the ticket (shown as number “687” in FIG. 12B andgenerically as x in FIG. 12C) in a specialized way as described below.Messages from FIG. 12C that are identical to those in FIG. 12B areidentified with the same reference number and modified messages areidentified with the corresponding reference number from FIG. 12B with anappended “a”.

With specific reference to the information sequence diagram of FIG. 12C,messages 730, 732 and 734 are unchanged. The service provider front end205, however, generates a pair of nonces x and y before sending theticket message 734 rather than just one nonce. The value of x is arandom number; the value of y depends on the value of x. x is sent tothe service provider agent 220 in the ticket message 734 as part of thefield bookstore:x@spft.net:4567, but y is kept as a secret in theservice provider front end memory.

After receiving the ticket message 734, the service provider agent 220does not simply forward the ticket to the user terminal as in FIG. 12B.Rather, the service provider agent 220 modifies x according to thefollowing formula:

-   -   x_(service provider)≡ƒ₁ (service provider ID, x)        At message 736 a the service provider agent 220 sends        x_(service provider) in the modified ticket ticket.SP in the        field bookstore: x_(service provider)@spft.net:4567. The user        terminal/token interface 222 receives ticket.SP and presents it        to the token 27. The token 27 modifies x_(service provider) to        derive:    -   x_(token)≡ƒ₂(user ID, x_(SP))        The token 27 provides a modified ticket ticket.T containing the        field bookstore: x_(token)@spfe.net:4567 to the user        terminal/token interface 222, which forwards this ticket. T to        the user front end 208 in message 740 a.

The user front end 208 forwards this ticket.T in message 742 a to theservice provider front end 205. When the service provider front end 205receives ticket.T, the final calculation is performed:

-   -   data container identifier≡ƒ₃(x_(token), y)        The functions ƒ₁, ƒ₂ and ƒ₃ along with the values of the pair        (x, y) ensure that the data container identifier depends only on        the user ID/service provider ID pair, and not on x or y, and        that the data container identifier is unique for all service        provider ID/user ID pairs. y serves to remove the influence of x        on the output of f₃.

One possible implementation of the above protocol is based on thePaillier Cryptosystem. To use this algorithm two constant parameters arerequired. The first is a Paillier Cryptosystem public key (known to allparticipants) and some constant number c, used because Paillier cannotencode negative numbers. c introduces an offset in a data containeridentifier, e.g.,

-   -   service provider ID|user ID+c        thus accounting for Paillier features while leaving a unique        data container identifier. In this case the service provider        front end 205 obtains or generates a random number y, encrypts        it with a Paillier public key to form random number x and sends        the number to the service provider agent 220 in message 734 a.        The service provider front end 205 records y for later use. Thus        the random number x corresponds to an encrypted version of y,        i.e.,    -   x≡ƒ_(encrypt)(y, Pailler public key)≡(Pailler public key)^(y)        The public key for decryption is known to the locations        participating in the procedure. The service provider agent 220        also uses a bit-shifted version of the service provider ID.        Specifically the service provider agent 220 bit-shifts the        service provider ID by the number of bits in the user ID:    -   SPID_(shifted)≡service provider ID×2^(bit length of user ID)        The service provider agent does not know the user ID but does        know the number of bits in the user ID. (As a consequence of        this bit-shift:    -   SPID_(shifted)+user ID=service provider ID|user ID        Assume the service provider ID is 110011 and the user ID        is 010101. If one were to concatenate these IDS, the service        provider ID would be left-shifted six bit positions, the number        of bits in the user ID, to become 110011000000. Adding the user        ID to this value would equate to the concatenation of service        provider ID and user ID: 110011010101.) The service provider        agent 220 multiplies the encrypted result of the bit shift        SPID_(shifted) by x to form x_(service provider):

$\begin{matrix}{x_{{service}\mspace{14mu}{provider}} \equiv {f_{1}\left( {{{service}\mspace{14mu}{provider}\mspace{14mu}{ID}},x} \right)}} \\{\equiv {x \times {f_{encrypt}\left( {{SPID}_{shifted},{{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}}} \right)}}} \\{\equiv {{f_{encrypt}\left( {y,{{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}}} \right)} \times}} \\{f_{encrypt}\left( {{SPID}_{shifted},{{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}}} \right)} \\{\equiv {\left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{y} \times}} \\{\left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{{SPID}_{shifted}}} \\{\equiv \left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{+ {SPID}_{shifted}}}\end{matrix}$All multiplications are modulus operations. The token 27 then encryptsthe user ID with the public key and multiplies the result byx_(service provider) to derive x_(token):

$\begin{matrix}{x_{token} \equiv {f_{2}\left( {{{user}\mspace{14mu}{ID}},x_{SP}} \right)}} \\{\equiv {x_{{service}\mspace{14mu}{provider}} \times {f_{encrypt}\left( {{{user}\mspace{14mu}{ID}},{{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}}} \right)}}} \\{\equiv {\left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{y + {SPID}_{shifted}} \times \left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{{user}\mspace{14mu}{ID}}}} \\{\equiv \left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{y + {SPID}_{shifted} + {{user}\mspace{14mu}{ID}}}} \\{\equiv \left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{y + {({{{service}\mspace{14mu}{provider}\mspace{14mu}{ID}}|{{user}\mspace{14mu}{ID}}})}}}\end{matrix}$The service provider front end 205 performs the final transformation byencrypting the difference c−y and multiplying the result by what itreceived from the token 27, thus obtaining a data container identifier:

$\begin{matrix}{{{data}\mspace{14mu}{container}\mspace{14mu}{identifier}} \equiv {f_{3}\left( {x_{token},y} \right)}} \\{\equiv {x_{token} \times {f_{encrypt}\left( {{c - y},{{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}}} \right)}}} \\{\equiv {\left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{y + {({{{service}\mspace{14mu}{provider}\mspace{14mu}{ID}}|{{user}\mspace{14mu}{ID}}})}} \times}} \\{\left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{c - y}} \\{\equiv \left( {{Pailler}\mspace{14mu}{public}\mspace{14mu}{key}} \right)^{{({{{service}\mspace{14mu}{provider}\mspace{14mu}{ID}}|{{user}\mspace{14mu}{ID}}})} + c}}\end{matrix}$

Per the foregoing description, the service provider front end 205 canderive the data container identifier without the user ID beingtransmitted through the system. The data container identifier can bederived by the service provider front end 205 after receipt of message742 a.

Messages 744 through 750 are used only to synchronize the userterminal/token interface 222 (i.e., the browser) and the serviceprovider agent 220 (i.e., the HTTP server). Messages 744 through 748 and752 through 756 are identical to those discussed above in connectionwith FIG. 12B. Message 750 a is simply a GETDATA( ) request as no ticketis required.

FIG. 12D illustrates a second alternative embodiment of the messagesequence diagram of FIG. 12B. In this embodiment, the token 27calculates the data container identifier using the service provider IDand the user ID. As such, the user ID does not have to be transmittedoutside of the token 27. Messages from FIG. 12D that are identical tothose in FIG. 12B are identified with the same reference number, andmodified messages are identified with the corresponding reference numberfrom FIG. 12B with an appended “b”. Additional messages 747 and 749 arealso illustrated.

With specific reference to the information sequence diagram of FIG. 12D,messages 730, 732, 734, and 736 are unchanged. The token authenticationprocess illustrated by messages 738 b is the same as that describedabove for messages 738 of FIG. 12B only the user ID is not transmittedfrom the token 27 to the user front end 208. Message 740 is unchanged.The ticket (and not the user ID) is sent from the user front end 208 tothe service provider front end 205 in message 742 b.

At message 744 b the service provider front end 205 sends the serviceprovider ID to the user front end 208.

At message 746 b the user front end 208 sends this service provider IDto the token 27 via user terminal/token interface 222.

The method sends messages 748 and 750 as with the method of FIG. 12B. Inparallel, however, the token 27 calculates the data container identifierusing the received service provider ID and its own internally storeduser ID. Optional additional codes may be used to determine the datacontainer identifier. The token 27 sends this data container identifierto the user front end 208 in message 747, which in turn sends the datacontainer identifier to the service provider front end 205 with theticket in message 749.

Messages 752, 754 and 756 are unchanged from the description of FIG.12B.

Key Management:

The key management system 212 is responsible for generating new tokens27 and initial registration of those tokens in the system. The keymanagement system 212 is also responsible for token deactivation andtoken replacement.

In one exemplary embodiment the key management system 212 is amulti-part system as illustrated in the block diagram of FIG. 13. Thekey management system 212 includes smart card personalization equipment212 a. In embodiments the smart card personalization equipment 212 a isa special-designed computerized machine that produces smart cards andwrites data into smart card memory. This smart card personalizationequipment 212 a is controlled by the key management core 212 c, whichservices commands from an operator's console 212 d (e.g., requests toproduce new batches of tokens). Another source of requests to producenew tokens comes from the key management web service 212 b (e.g., tokenreplacement requests) or other similar program.

For security reasons it is preferred that user IDS are not stored in thesystem. Therefore a master token 260 is used to replace lost orcompromised tokens 27. The master token 260 holds the information neededto replace an old token 27 (e.g., a representation of token ID, user IDand the optional data encryption key(s)). When a user is authenticatedin the system with his master token 260, a new token 27/master token 260pair may be generated and sent to the user. At the same time theprevious working tokens 27 are deactivated (e.g. by triggering adeactivation flag for the token ID in the data container associated withthat token 27 and the authentication service).

FIG. 14 is a message sequence for replacement of a token 27. Theprocedure is quite close to that depicted in FIG. 12A. To deactivate alost or stolen token 27, the user directs the browser of the userterminal/token interface 222 to the key management service webpage(provided by the key management web service 212 b of key managementsystem 212) and authenticates himself using his master token 260.Similar to message 701 of FIG. 7A, at message 905 the master token 260,through the user terminal/token interface 222, provides a master tokenID to the user front end 208.

Like message 703 of FIG. 12A, at message 910 the user front end 208calculates a data container identifier from the TSPID and the mastertoken ID. The user front end 208 sends this data container identifier tothe dispersed data storage management system 210 with a READ request;i.e., READ(data container identifier).

The dispersed data storage management system 210 uses the data containeridentifier to retrieve the data container containing the master token260's secret key(s) and token status from the dispersed data storagesystem 216. At message 915 (like message 705 of FIG. 12A), thisinformation is sent to the user front end 208 as part of a datacontainer.

Messages 920 to complete mutual authentication, like messages 707 ofFIG. 12A, are then exchanged between the user front end 208 and thetoken 27.

When compared to the encrypted message 709 (FIG. 12A), encrypted message925 carries additional information: the token ID, user ID, and theoptional data encryption key and the algorithm identification of thetoken 27 to be replaced. This additional information and the mastertoken ID are stored in the ticket 927.

Messages 930 through 945 show the ticket path through the system and arefully equivalent to messages 711 through 717 of FIG. 12A except that thekey management core 212 c replaces the service provider front end 205.In fact, the key management core 212 c can play the role of a serviceprovider front end for key management web service 212 b, which in turncan be considered as a service provider. The difference, however, isthat after production of a ticket, the key management core 212 creceives from the user front end 208 not only the user ID and optionaldata encryption key/algorithm, but also the ID of the token 27 to bereplaced (message 950).

At this point in the sequence the key management system 212 has all theinformation necessary to produce a new pair of tokens (a normal everydaytoken 27 and master token 260) that will point to the same user ID. Newtoken IDS and secret keys are generated for the pair of tokens 27, 260and this information is written into new tokens 27, 260 by the smartcard personalization equipment 212 a. As illustrated by message 955, anew token record is provided to the dispersed data storage managementsystem 210 and any old tokens 27, 260 will be marked as deactivated.Message 960 reports the success/failure status of the operation to thekey management web service 212 b for communication back to the userterminal/token interface 222 in message 965.

Security Measures:

A number of measures are taken in the system to keep authenticationsecrets and data as safe as possible. First, identifiers (i.e., tokenID, service provider ID, user ID) used in the system should be longinteger numbers; for example, at least 64 bits in length. Those numbersare produced by a random number generator. This makes it difficult tofind existing identifiers by an exhaustive search method. Second, alldata exchange is preferably secured with secret keys that are at least128 bits long. Furthermore, data container identifiers are one-wayciphered (e.g., encrypted) with resulting name lengths being more than512 bits. It is impossible (in any practical manner) to restore the userID and/or service provider ID from a data container identifier. Dataitself may be stored in encrypted form with secret keys that are hashesof the service provider ID and the user ID and that are known to thesystem only for the active period when the user communicates with thesystem. Moreover, as a service provider option, data containers may beciphered (e.g., encrypted) by the service provider before they are sentto the A&DDS system. Finally, in embodiments, the A&DDS system does notstore (on any permanent basis) the service provider ID assigned to agiven service provider or the user ID assigned to a token. As such, theA&DDS system by itself cannot gain access to a data container associatedwith a service provider ID/user ID pair without the service provider andtoken going through the requisite authentication procedures. That is,since the A&DDS system does not separately maintain lists of user IDSand service provider IDS, neither it nor unscrupulous other parties canderive the data container identifier needed to recover or retrieve thedata container.

EXAMPLES OF USE

An exemplary use of the A&DDSM system described herein is for providingthird party authentication services in a service provider/usertransaction and for safely storing the user's profile data on behalf ofthe service provider. A typical service provider/user interaction wouldbe between a vendor (e.g., on-line bookstore) and a user who has anaccount with the vendor. The user accesses the vendor's website,presents the token, the authentication procedure is performed and if theuser is authenticated, the data container containing the user's profiledata (e.g., name, account information, customer loyalty information,billing information, etc.) is retrieved for use by the vendor. When thetransaction is completed, the data can be updated and the vendor sendsthe data container back to the A&DDS system for safe storage. In anothertypical use of the system, the user can present the token to a suitableterminal at the physical store of the vendor. The authenticationprocedure is again performed and, if authentication is successful, thedata container containing the user's profile information is retrieved.When the transaction is completed, the data can be updated and thevendor sends the data container back to the A&DDS system for safe datastorage. This application relieves the user of the need to carrymultiple loyalty cards for multiple vendors.

ON-LINE RETAILER EXAMPLE

Application of the system in an on-line retail environment is nowdiscussed. In this example there are three participants in the system:(1) the on-line retailer; (2) the customer (e.g., the individual thatshops with the on-line retailer); and (3) the third-party authenticator(i.e., the entity that runs the A&DDS management system 204.

The customer establishes an account with the third-party authenticatorand the third-party authenticator issues one or more tokens 27 and amaster token 260 to the customer. For example, in the case of hardwaretokens, these tokens are mailed to the customer. If the token is anapplication that runs on the customer's smart phone or personal dataassistant, the token application is downloaded to the device by thecustomer. The tokens 27 include the user ID and encryption key(s)discussed above, and the master token 260 includes the user ID, mastertoken ID and encryption key(s) discussed above. A data container isstored in the system corresponding to each token, including the key(s)for token authentication and token status. This data container isaccessed using the token ID and another data element (e.g., serviceprovider ID of the third-party authenticator).

The on-line retailer also establishes a relationship with thethird-party authenticator to provide third-party authentication servicesand third-party data storage for the on-line retailer. The third-partyauthenticator provides any necessary software and tokens forcommunications with the A&DDS system and provides the service providerID to the on-line retailer. The on-line retailer then adds an icon orother selectable link on its website.

In this example, it is assumed that the customer has established arelationship with (i.e., registered with) the on-line retailer. That is,the customer has at some point provided user information to the on-lineretailer, which the on-line retailer uses to create a customer profileassociated with the customer. This customer profile can includeinformation such as customer name, address, customer account number,financial instrument information (e.g., credit card number and billingaddress), account username, customer preferences, and the like. Notethat there is no need for a user password as the user has already beenauthenticated. Over time, the on-line retailer can supplement thisinformation with historical information such as the customer's purchasehistory, trends and preferences, loyalty status, etc. The on-lineretailer provides this information to the third-party authenticator as adata container for storage in the dispersed data storage system 216.This data container is identified and retrieved using a data containeridentifier, which is derived from the service provider ID assigned tothe on-line retailer and the unique user ID stored in the token 27issued to the customer. The process for initial creation of a datacontainer is identical to requesting a data container (i.e., READcommand) except messages 721 (FIG. 12A) and 752 (FIGS. 12B, 12C and 12D)send the data container identifier with a CREATE rather than READrequest. In response to the CREATE request, a data container is createdat location specified by the data container identifier. Data for initialstorage in the container can also accompany the CREATE request.

The customer accesses the website of the on-line retailer and clicks onthe authentication icon (or link) displayed on the webpage. Optionally,a new webpage is displayed prompting the customer to present thecustomer's token, such as by connecting the token to the USB interfaceof the customer's home computer. The name of the on-line retailer may bedisplayed on the customer's token, and the customer hits the consentbutton on the token. The authentication procedures discussed above forauthenticating the token (and thus the customer) and the serviceprovider are performed amongst the customer's token, the serviceprovider ID of the on-line retailer and the A&DDS system operated by thethird-party authenticator. Assuming the on-line retailer and thecustomer have been properly authenticated, the third party authenticatoruses a data container identifier (derived using the user ID of thecustomer's token and the service provider ID assigned to the on-lineretailer) to retrieve and/or reconstruct from the dispersed data storagesystem 216 the data container associated with the on-lineretailer/customer pair and transmits this data container to the on-lineretailer. The data container contains the customer's user profile. Assuch, the identify and user information of the customer is revealed tothe on-line retailer and can be used in interacting with the customerand performing transactions (e.g., purchases). If no changes are made tothe data, the session can terminate (with no changes to the datacontainer in the dispersed data storage system 216) or the received datacan be written back into the dispersed data storage system 216 with aWRITE request.

POINT-OF-SALE RETAILER EXAMPLE

The system operates in much the same way with commerce applications thatare not electronic, e.g., where the customer visits the retail locationof the service provider. In this example, assume the service provider isa retail bookstore (Retail Bookstore). Rather than the customer logginginto a website, the customer presents the customer's token to a tokeninterface connected to the Retail Bookstore's point-of-sale terminal orkiosk. The point-of-sale terminal acts as the customer's user terminal(i.e., home computer) and communicates between the token and the userfront end 208 of the third party authenticator's A&DDS system.Authentication of the customer and the Retail Bookstore is performed asdescribed above and if successful the third party authenticatorretrieves the data container associated with the RetailBookstore/customer pair and provides the data container to the RetailBookstore. For example, the data container is provided to the RetailBookstore's system for display to the retail associate with thepoint-of-sale terminal. As such the identity of the customer, billinginformation, loyalty status, etc. are available to the retail associate.

EMPLOYEE RIGHTS TO ACCESS RESOURCE EXAMPLE

The service provider may choose to trust the A&DDS management system 204with storing data associated with a specific user. Alternatively, incases where the service provider already has a large investment in areliable database and does not want to redesign its core technologies,it is possible to store within the dispersed data storage system 216only certain pieces of information, such as the service provider's localIDs that it associates with the presented user. It should be understoodthat this form of data need not necessarily be, but may be, stored in adispersed format. This particular approach can be used to allowemployers to authenticate their employees and provide access to securecorporate resources. The employer/corporate entity is considered theservice provider and the employee is the user. The employee can use thesame token 27 at work that the employee uses for other service providers(e.g., on-line retailers). If the employee does not already have atoken, then one can be provided. The token can be used to gain access tosecure areas (e.g., to gain access to the building, restricted floors,etc.) and to log-in to the corporate network.

When the user plugs (or otherwise interfaces) the token into her workcomputer, the authentication process described above is performed. Thedata container identifier, which is derived using the user ID assignedto the employee and the service provider ID of the employer, is used toretrieve from the A&DDS system of the third party authenticator theemployee's local ID for the employer's system. The employer's system hasbuilt-in authorization procedures it follows to determine what resourcesthis employee can access.

The employer benefits in a number of ways. For example, assuming theemployee also uses the token in the employee's personal life (e.g., inon-line and point of sale transactions), the token has more value forthe employee than a typical corporate access device (e.g., key fob). Theemployee, therefore, will be careful not to leave the token connected tohis or her computer during lunch, etc. Moreover, to the extent theemployee already has a token, there is no cost to the employer forsupplying the token. There is also no need to return the token when theemployee departs the company since there is nothing on the token itselfconcerning the employer. When the employee leaves the company, thesystem administrator simply changes the authority level associated withthe employees internal ID. No changes in the data stored by the A&DDSmanagement system 204 are required to effectively lock the employee out.

While the data storage aspects of the system have been described aboveprincipally in connection with safe storage of private data, it shouldbe understood that the system is not so limited. Rather, the system canused to store, and provide authentication services in connection with,any protected resource. The resource may be a software application, anobject or place, a document, a webpage, a file, executable code, orother computational resource, communication-type resource, etc. that isonly accessed or retrieved if the user and service provider are bothauthenticated. Possible applications of the technology described hereinalso include, but are not limited to:

-   a) use of Internet resources;-   b) authorization for use of software programs or hardware (e.g., to    get an access to a program, or to special features, as a service);-   c) loyalty cards and other customer identification means in stores,    restaurants, etc.;-   d) transport cards (e.g., public transit, ski lifts, etc.);-   e) use of safe storage of credit/debit cards account information    and/or facilitating secure internet payment or other secure    financial transaction (e.g., brokerage transaction);-   f) secure access identification systems for entrance to buildings,    logging into work, and the like;-   g) post-financial transaction transactions, such as a proxy for    boarding passes, e-badges, tickets (e.g., movie or concert tickets);-   h) personal healthcare information management and access;-   i) integration of the backend storage system with existing    authentication and identification systems;-   j) secure and anonymous electronic elections, voting, etc.;-   k) centralized documents storage for driver's license and other    personal data;-   l) digital signature and security certificates;-   m) authorization for micropayments, pay-as-you-go, or pay-per-use;-   n) user-to-user connections, e.g., business cards exchange;-   o) billing systems, such as precise, up to the second registration    of a service provider (e.g., attorney) time dedicated to a    particular user's matter;-   p) e-mail spam elimination, meaning only authenticated entities    (service providers or customers) can send email messages to other    authenticated entities;-   q) authentication at corporate networks and workstations; and,-   r) storage of mail certificates which allow a user to use a mail    agent (e.g., Mozilla Thunderbird™ agent or Microsoft Outlook®) on    any computer.

Although the invention has been described in terms of exemplaryembodiments, it is not limited thereto. Rather, the appended claimsshould be construed broadly to include other variants and embodiments ofthe invention that may be made by those skilled in the art withoutdeparting from the scope and range of equivalents of the invention.

What is claimed is:
 1. A computer-implemented method comprising:receiving data; generating, by a computer system, multiple data segmentsusing calculations based on portions of the data, such that the data canbe recreated based on at least some of the data segments; generating adata container identifier including generating a one way permutationusing data related to a user and data related to a service provider,where the one way permutation is a function in which the data related tothe user and the data related to the service provider cannot bedetermined by knowing the data container identifier; determining storagelocations based on the data container identifier; storing the datasegments in different storage locations in multiple, different storagezones, with each of the storage zones storing less than a number of datasegments required to recreate the data, and such that the data can berecreated based on the data segments retrieved from less than all of thestorage locations; identifying a particular set of storage locationsbased on the data container identifier by regenerating the datacontainer identifier by regenerating the one way permutation using thedata related to the user and the data related to the service provider;retrieving the data segments from the particular set of storagelocations; and manipulating the retrieved data segments to recreate thedata.
 2. The method of claim 1, further comprising preventing recreationof the data from data segments retrieved from a single storage zone. 3.The method of claim 1, further comprising preventing recreation of thedata from data segments retrieved from a less than a specified number ofthe storage zones.
 4. The method of claim 1, wherein storing the datasegments in different storage locations comprises storing the datasegments on storage media dispersed across multiple networked computers.5. The method of claim 1, wherein: receiving the data comprisesreceiving encrypted data with the encrypted data being encrypted usingan encryption key and encryption algorithm associated with the user, theencryption key and identification of the encryption algorithm beingstored on one or more tokens associated with the user; recreating thedata comprises recreating the encrypted data; and the method furthercomprises decrypting the recreated encrypted data using the encryptionkey and encryption algorithm associated with the user.
 6. The method ofclaim 1, wherein different storage locations comprise differentnetworked storage nodes with each storage node including one or morenetworked computers and their associated data storage media.
 7. Themethod of claim 1, wherein each of the multiple storage zones is locatedin a geographical area that is different from the geographical area ofthe other ones of the multiple storage zones.
 8. The method of claim 1,wherein each of the multiple storage zones exists under a set of legaljurisdictions that is different from set legal jurisdictions of theother ones of the multiple storage zones.
 9. The method of claim 1,wherein storing the data segments in different storage locationscomprises storing each data segment at a point within a storage locationspecified by a combination of data related to the user and data relatedto the service provider.
 10. The method of claim 9, further comprisingauthenticating the user and the service provider before storing orrecreating the data.
 11. The method of claim 1, wherein generating thedata container identifier comprises performing a one-way function basedon a user ID, a service provider ID, and one or more additional inputs.12. The method of claim 1, wherein generating multiple data segmentsusing calculations involving portions of the data comprises generatingmultiple data segments with each segment including a portion of lessthan all of the data with some portions of the data being included inmultiple, different data segments.
 13. The method of claim 1, whereingenerating multiple data segments using calculations involving portionsof the data comprises generating multiple data segments where some ofthe data segments include identical portions of the data.